Review reviewCritical

CVE-2025-4517

Python Software Foundation CPython

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new...

CVSS: 9.4
EPSS: -
CISA KEV: Not listed
Published: 2025.06.03

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 9.4

Vulnerability overview

Affected product and versions

Product: Python Software Foundation CPython
Affected versions: < 3.9.23, >= 3.10.0 < 3.10.18, >= 3.11.0 < 3.11.13, >= 3.12.0 < 3.12.11, >= 3.13.0 < 3.13.4, >= 3.14.0a1 < 3.14.0b3
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Python Software Foundation CPython and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE: CWE-22