Extraction filter bypass für das Verlinken außerhalb des Extraktionsverzeichnisses

The core of this vulnerability lies in the tarfile module's handling of extraction filters. When using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar", the filter logic can be bypassed. This bypass allows an attacker to craft a malicious tar archive containing symlinks that point outside the intended extraction directory. Consequently, an attacker could overwrite or delete files in arbitrary locations on the system, potentially gaining unauthorized access or disrupting system operations. The blast radius extends to any system where untrusted tar archives are processed using the vulnerable tarfile module, especially in automated scripts or web applications.

Systems that automatically process untrusted tar archives, such as build servers, data ingestion pipelines, or web applications that allow users to upload archives, are particularly at risk. Environments using older Python versions (3.10.0 - 3.14.0b3) are also vulnerable. Shared hosting environments where multiple users can upload files are also at increased risk.

• python / server:

find / -name '*.tar.gz' -o -name '*.tar.bz2' -o -name '*.tar'

• python / server:

journalctl -u python3 | grep "TarFile.extractall" | grep "filter="

• python / server:

ps aux | grep "TarFile.extractall" | grep "filter="

1. 2025-06-03Disclosure

   disclosure

1. Reserviert2025-05-05
2. Veröffentlicht2025-06-03
3. Geändert2026-04-21
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-4330 is to upgrade to Python version 3.14.0b3 or later, where the default value of the filter parameter has been changed to prevent this bypass. If upgrading is not immediately feasible, avoid using the filter parameter with values of "data" or "tar" when extracting untrusted tar archives. Consider implementing input validation to ensure that the tar archive does not contain malicious symlinks before extraction. For environments where upgrading is impossible, carefully review and restrict the directories where tar archives are extracted. After upgrading, confirm the fix by attempting to extract a known malicious tar archive containing symlinks outside the intended extraction directory; the extraction should fail.