CVE-2025-4138

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

• CWE-22

• https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
• https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
• https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
• https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
• https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
• https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a
• https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
• https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01
• https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
• https://github.com/python/cpython/issues/135034
• https://github.com/python/cpython/pull/135037
• https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

Published

Jun 3, 2025

Last Modified

Jul 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41374A SQL injection vulnerability has been found in Gandia Integ…8.8
• CVE-2025-41375SQL Injection vulnerability in Limesurvey v2.65.1+170522. Th…9.8
• CVE-2025-41376CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  …5.3
• CVE-2025-41377A SQL injection vulnerability has been found in Gandia Integ…8.7
• CVE-2025-41378The SSID field is not parsed correctly and can be used to in…6.9
• CVE-2025-41379The Intellian C700 web panel allows you to add firewall rule…6.3
• CVE-2025-41380Iridium Certus 700 version 1.0.1 has an embedded credentials…6.1
• CVE-2025-41384Cross-Site Scripting (XSS) vulnerability reflected in SuiteC…6.1
• CVE-2025-41385An OS Command Injection issue exists in wivia 5 all versions…7.2
• CVE-2025-41388Fuji Electric Smart Editor is vulnerable to a stack-based bu…8.4
• CVE-2025-4139A vulnerability classified as critical was found in Netgear …8.8
• CVE-2025-41390An arbitrary code execution vulnerability exists in the git …7.8