CVE-2025-4435 Tarfile extracts filtered members when errorlevel=0
Attackers can bypass tarfile extraction filters when errorlevel is set to 0, potentially writing files to unintended locations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4435?
CVE-2025-4435 is a high-severity path traversal vulnerability in CPython, published on 3 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.
Weakness: CWE-682
Which versions are affected by CVE-2025-4435?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
python Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
python-min Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
How do I fix CVE-2025-4435?
Upgrade libpython to a fixed version for your release line: 3.9.23, 3.10.18, 3.11.13 or 3.12.11.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-4435 being exploited?
There is no known exploitation of CVE-2025-4435 in the wild and no public exploit code.
Sources
Also known as AZL-62298, BELL-CVE-2025-4435, BIT-libpython-2025-4435, BIT-python-2025-4435, BIT-python-min-2025-4435, DEBIAN-CVE-2025-4435 and 8 more.