CVE-2025-8194
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A defect in CPython's tarfile module affects TarFile extraction and entry enumeration APIs. Tar archives with negative offsets cause an infinite loop and deadlock during parsing of malicious archives.
Risk Assessment
An attacker can cause a denial of service (DoS) by providing a malicious tar archive that blocks the parsing process.
Recommendation
Apply the patch available at https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 after importing the tarfile module. Consider updating Python to a patched version.
Other vulnerabilities in Python tarfile
See all- CVE-2026-19672Medium
The tarfile module in Python has a vulnerability in its extraction filters that allows creating directories outside the destination for members whose name leaves the destination and returns to it (e.g., ../evil/../dest/sub/file). The issue affects only POSIX platforms and creates only empty directories outside the destination.
- CVE-2026-11940High
The tarfile.extractall() function with the 'data' or 'tar' filter can be bypassed by a crafted archive where a hardlink references a symlink stored deeper than the hardlink itself. This allows creating a symlink pointing outside the destination directory, enabling out-of-destination file reads or writes. This is an incomplete fix of CVE-2025-4330.
- CVE-2025-4330High
Vulnerability in Python's tarfile module allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory and modification of file metadata. Affects TarFile.extractall() or TarFile.extract() with filter='data' or 'tar'.
Original NVD description (English source)
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1