CVE-2025-4517

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

• CWE-22

• https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
• https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
• https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
• https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
• https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
• https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a
• https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
• https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01
• https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
• https://github.com/python/cpython/issues/135034
• https://github.com/python/cpython/pull/135037
• https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

Published

Jun 3, 2025

Last Modified

Jul 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4515A vulnerability, which was classified as problematic, was fo…6.5
• CVE-2025-45150Insecure permissions in LangChain-ChatGLM-Webui commit ef829…9.8
• CVE-2025-45156Splashin iOS v2.0 fails to enforce server-side interval rest…5.3
• CVE-2025-45157Insecure permissions in Splashin iOS v2.0 allow unauthorized…6.5
• CVE-2025-4516There is an issue in CPython when using `bytes.decode("unico…5.9
• CVE-2025-45160A HTML injection vulnerability exists in the file upload fun…5.4
• CVE-2025-4519The IDonate – Blood Donation, Request And Donor Management S…8.8
• CVE-2025-4520The Uncanny Automator plugin for WordPress is vulnerable to …4.3
• CVE-2025-4521The IDonate – Blood Donation, Request And Donor Management S…8.8
• CVE-2025-4522The IDonate – Blood Donation, Request And Donor Management S…6.5
• CVE-2025-4523The IDonate – Blood Donation, Request And Donor Management S…6.5
• CVE-2025-45236A stored cross-site scripting (XSS) vulnerability in the Edi…5.4