CVE-2025-4517 (tarfile)

1. Vulnerability Overview

• Vulnerability Type: Path Traversal leading to Arbitrary File Write.
• CVSS Score: Common Vulnerability Scoring System (CVSS) v3.1 score is 9.4 (Critical).
• Affected Component: The tarfile module in the Python standard library.
• Core Impact: When a program extracts an untrusted .tar archive file, an attacker can use a specially crafted malicious archive to write files to arbitrary system paths outside the target extraction directory. This can lead to sensitive file overwriting, unauthorized code execution, or even complete system compromise.

2. Technical Details

In Python’s tarfile module, developers typically use the specialized functions tarfile.TarFile.extractall() or tarfile.TarFile.extract() to extract files.

To enhance extraction security, Python introduced a filter parameter mechanism (e.g., to filter out dangerous symbolic links). However, the core issue of CVE-2025-4517 lies precisely in a design flaw within this filtering mechanism: when developers set the filter parameter to "data" or "tar", the tarfile module fails to properly validate and normalize the target paths of symbolic links or hard links.

Underlying Logic Flaw: This is fundamentally a mismatch between path validation and path realization. During low-level processing (e.g., calling the operating system’s os.path.realpath() function under PATH_MAX limit conditions), if a malicious .tar file contains malicious member names pointing to ../../../../etc/passwd or other critical system directories, the "data" filter of tarfile cannot successfully intercept them.

As a result, files that were supposed to be confined within a secure extraction directory breach the boundary and are written across directories to absolute system paths.

3. Affected Versions and High-Risk Triggers

High-Risk Triggers: The code is vulnerable if it simultaneously meets the following conditions:

1. It extracts tar archive files from untrusted external sources (e.g., user uploads, network-downloaded resource packages, etc.).
2. It calls the extraction function with a specific filter in the code: tarfile.TarFile.extractall(filter="data") or tarfile.TarFile.extract(filter="data").

Special Note: In Python 3.14 and later versions, the default value of filter has been changed from "no filtering" to "data". This means that even if developers do not explicitly specify a filter, code relying on the new default behavior will be automatically affected.

Python Versions with Published Fixes: The Python Software Foundation has fixed this issue in the following updated versions:

• Python 3.13.4
• Python 3.12.11
• Python 3.11.13
• Python 3.10.18
• Python 3.9.23

4. Exploitation Scenarios

From a Red Teaming or Penetration Testing perspective, due to its low attack barrier and lack of required user interaction, this vulnerability is highly suitable as a springboard for gaining Initial Access:

• Continuous Integration / Continuous Deployment Pipelines (CI/CD): CI/CD runners frequently pull and unpack build artifacts from image repositories or caches. Red teams can poison a malicious .tar package, which upon extraction can directly overwrite the runner’s SSH keys or environment variable configuration files.
• Machine Learning Pipelines (ML): When loading external pre-trained model weight packages (usually packaged as .tar or .tar.gz), if the model files are implicitly trusted in automated processing scripts, this vulnerability can be easily triggered to overwrite the execution logic of the model loader.
• Automated Sandboxes / Plugin Ecosystems: When automatically extracting and analyzing unknown files or installing third-party plugins, the sandbox environment may be breached, leading to control over the host machine.

5. Mitigation and Workarounds

1. Upgrade: The most direct and thorough solution is to upgrade the Python in the affected environment to the corresponding secure patched version mentioned above.
2. Code-level Workarounds:
   • Zero Trust Principle: Until Python is updated, never blindly unpack .tar packages from untrusted sources.
   • Strict Path Validation: If unpacking is unavoidable, do not rely on the default protection of filter="data". Before calling the unpacking function, you should write your own strict path validation logic. For example, iterate over the objects returned by tarfile.TarFile.getmembers(), check if tarinfo.name contains ../, or calculate whether the merged absolute path remains strictly within the expected secure folder.
   • Run with Reduced Privileges: Run the Python process executing the unpacking task under the principle of least privilege. Even if unauthorized writes occur, the impact can be contained within a specific low-privilege user scope.