Vulnerability · critical · CVSS 9.4
CVE-2025-4517 Python tarfile flaw: patch verification and incident response
Tier A · Patch today – Before you go home
Who’s exposed: Services extracting untrusted tar archives with filter='data' or filter='tar'
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Verify that the patch is applied in containers and dependencies, not only in one interpreter
- Review archive-handling services that use filter="data" or filter="tar" as part of incident response
The Brief
- CVE-2025-4517 is a Python tarfile path validation flaw rated critical in the sources.
- A crafted archive can write files outside the extraction directory when an application uses filter="data" or filter="tar".
- The flaw can bypass the intended path boundary even when application code uses those tar filters.
Why it matters
Services that extract tar archives from untrusted sources may be exposed to arbitrary file writes, so checking only one Python interpreter may leave other deployed copies vulnerable.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Python tarfile is used by developers and ops teams running archive-handling services and containers. |
| No | Core infrastructure | Judgment: a flaw in Python's tarfile module is a language-library flaw, not one of the listed core infrastructure systems. |
| Yes | Popular tool | Judgment: Python is a widely used language runtime, and its standard library tarfile module is used by many teams. |
| No | Exploited in the wild | DEV Community sources describe the flaw as a risk to assess and verify; neither reports observed attacks. |
| No | Public exploit | DEV Community sources describe the flaw and patch verification; neither says exploit code or a PoC is published. |
| Yes | Remote, no login | CVSSCVE-2025-4517: CVSS 9.4 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2025-4517: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Sources report no stolen credentials, tokens, keys, configs, source code or customer data. |
| No | Supply chain | Sources describe a path validation flaw in tarfile; they do not report malicious code shipped through a trusted channel. |
| No | No fix yet | Sources discuss patch verification for CVE-2025-4517 in containers and dependencies, implying a patched version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2025-4517 ↗CVSS 9.4 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Arbitrary writes via tarfile realpath overflow
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- 1.5% chance of exploitation in the next 30 days · higher than 74% of all CVEs
- Weakness
- CWE-22
Timeline
Full coverage · 2 sources
- 4h ago ↗
DEV Community: python
Patch verification for CVE-2025-4517 in containers and dependencies - 4h ago ↗
DEV Community: python
CVE-2025-4517 incident response for archive-handling services
First seen · 2 sources · Full story page · How tiers are decided