Arbitrary Filesystem Write Vulnerability in Python Tarfile Module

CVE-2025-4517

What is CVE-2025-4517?

CVE-2025-4517 is an arbitrary filesystem write vulnerability within the Python Tarfile module, a component used for reading and writing tar archive files in Python applications. This vulnerability chiefly affects applications that utilize the TarFile.extractall() or TarFile.extract() methods to extract untrusted tar archives. When these methods are used with the filter parameter set to "data" or the new default value of "data" in Python versions 3.14 and later, the vulnerability can be exploited, allowing attackers to write files to arbitrary locations outside the intended extraction directory. This can lead to unauthorized file access and potentially harmful modifications, posing a severe risk to the confidentiality, integrity, and availability of systems relying on this module.

Organizations that implement the Tarfile module for extracting tar archives, particularly from untrusted sources, may face significant security challenges due to this vulnerability. Its exploitation could enable malicious actors to deliver harmful payloads or take control of systems by manipulating the file system, thus undermining the security of software applications built using Python.

Potential impact of CVE-2025-4517

1. Unauthorized Filesystem Alterations: Attackers can leverage this vulnerability to write malicious files to unintended locations on the filesystem, which may lead to unauthorized access to sensitive data, configuration tampering, or the installation of further malware.

2. System Compromise: The ability to execute arbitrary writes can allow attackers to replace legitimate files with malicious ones or introduce backdoors, potentially leading to full control of the affected system and facilitating broader attacks on interconnected networks.

3. Reputation and Compliance Risks: Organizations affected by this vulnerability may face reputational damage and legal liabilities arising from data breaches or non-compliance with data protection regulations, particularly if sensitive or personal data is compromised as a result of an exploit.

References