CVE-2025-4517— Arbitrary writes via tarfile realpath overflow
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-4517
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary writes via tarfile realpath overflow
Source: NVD (National Vulnerability Database)
Vulnerability Description
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Python 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python 3.12及之后版本存在安全漏洞，该漏洞源于提取过滤器允许任意文件系统写入提取目录外。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Python Software Foundation | CPython | 0 ~ 3.10.18 | - |
II. Public POCs for CVE-2025-4517
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE‑2025‑4517 Proof‑of‑Concept Script | https://github.com/AnimePrincess420/CVE-2025-4517-PoC | POC Details |
| 2 | CVE-2025-4517 (CVSS 9.4 – Critical) A vulnerability in Python's `tarfile` | https://github.com/StealthByte0/CVE-2025-4517-poc | POC Details |
| 3 | Python tarfile data filter bypass via PATH_MAX overflow in os.path.realpath() - CVE-2025-4517 / CVE-2025-4330 | https://github.com/0xDTC/CVE-2025-4517-tarfile-PATH_MAX-bypass | POC Details |
| 4 | Privilege Escalation script for Wingdata | https://github.com/AzureADTrent/CVE-2025-4517-POC-HTB-WingData | POC Details |
| 5 | A high-performance Python toolkit to automate the CVE-2025-4517 PATH_MAX bypass exploit. Specifically tuned for the WingData HTB challenge to achieve arbitrary file writes and root persistence | https://github.com/Rohitberiwala/PyPath-Escape-CVE-2025-4517-Exploit-Research | POC Details |
| 6 | PoC and explanation for CVE-2025-4517 used in a CTF I was playing. | https://github.com/kerburenthusiasm/CVE-2025-4517-PoC | POC Details |
| 7 | None | https://github.com/ben-slates/CVE-2025-4517-POC-HTB-WINGDATA | POC Details |
| 8 | Path traversal vulnerability in Python's tarfile. | https://github.com/estebanzarate/CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC | POC Details |
| 9 | None | https://github.com/ben-slates/CVE-2025-4517-POC | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-4517
请登录查看更多情报信息。
Same Patch Batch · Python Software Foundation · 2025-06-03 · 5 CVEs total
| CVE-2025-4138 | 7.5 HIGH | Bypassing extraction filter to create symlinks to arbitrary targets outside extraction dir |
| CVE-2025-4330 | 7.5 HIGH | Extraction filter bypass for linking outside extraction directory |
| CVE-2025-4435 | 7.5 HIGH | Tarfile extracts filtered members when errorlevel=0 |
| CVE-2024-12718 | 5.3 MEDIUM | Bypass extraction filter to modify file metadata outside extraction directory |
IV. Related Vulnerabilities
Same product: CPython
- CVE-2026-3087
shutil.unpack_archive() doesn't check for Windows absolute p - CVE-2026-6019
BaseCookie.js_output() does not neutralize embedded characte - CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.soc - CVE-2026-5713
Out-of-bounds read/write during remote profiling and asyncio - CVE-2026-4786
Incomplete mitigation of CVE-2026-4519, %action expansion fo
Same vendor: Python Software Foundation
- CVE-2026-3087
shutil.unpack_archive() doesn't check for Windows absolute p - CVE-2026-6019
BaseCookie.js_output() does not neutralize embedded characte - CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.soc - CVE-2026-5713
Out-of-bounds read/write during remote profiling and asyncio - CVE-2026-4786
Incomplete mitigation of CVE-2026-4519, %action expansion fo
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2025-4517
No comments yet