Arbitrary Filesystem Write Vulnerability in Python Tarfile Module

CVE-2025-4517

What is CVE-2025-4517?

The vulnerability in the Python tarfile module allows for arbitrary filesystem writes when extracting untrusted tar archives with the filter parameter set to 'data' or 'tar'. This issue arises specifically in Python 3.12 or later. Users who employ the TarFile.extractall() or TarFile.extract() methods with these filters are at risk. Notably, starting from Python 3.14, the default filter value has changed from 'no filtering' to 'data', thus increasing potential exposure for users relying on this default behavior. It is recommended to evaluate the sources of tar archives to mitigate risks associated with installing potentially harmful source distributions.

References