CVE-2025-4138: Directory Traversal in Python tarfile

An attacker can exploit this vulnerability by crafting a malicious tar archive that, when extracted using TarFile.extractall() or TarFile.extract() with the filter='data' or filter='tar' parameter, allows them to write files outside the intended destination directory. This could lead to overwriting system files, injecting malicious code, or gaining unauthorized access to sensitive data. The potential impact is significant, as successful exploitation could compromise the entire system. The ability to modify file metadata further expands the attack surface, potentially allowing attackers to disguise malicious files or manipulate file access controls.

1. Reserved2025-04-30
2. Published2025-06-03
3. Modified2026-04-21
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to Python 3.14.0b3 or later, where the default value of the filter parameter has been changed to prevent this behavior. If upgrading is not immediately feasible, avoid using the filter parameter with values of 'data' or 'tar' when extracting untrusted tar archives. Alternatively, implement strict input validation and sanitization to ensure that the extraction path is within the expected directory. Consider using a dedicated tar archive extraction library with built-in security features. After upgrading, confirm the fix by attempting to extract a known malicious tar archive and verifying that it is prevented from writing outside the intended directory.