🔐 CVE Alert

CVE-2025-4435

HIGH 7.5

Tarfile extracts filtered members when errorlevel=0

CVSS Score
7.5
EPSS Score
0.5%
EPSS Percentile
68th

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

Vendor python software foundation
Product cpython
Published Jun 3, 2025
Last Updated Apr 21, 2026
Stay Ahead of the Next One

Get instant alerts for python software foundation cpython

Be the first to know when new high vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Affected Versions

Python Software Foundation / CPython
0 < 3.10.18 3.11.0 < 3.11.13 3.12.0 < 3.12.11 3.13.0 < 3.13.4 3.14.0a1 < 3.14.0b3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/python/cpython/issues/135034 github.com: https://github.com/python/cpython/pull/135037 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ github.com: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a github.com: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a github.com: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da github.com: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 github.com: https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 github.com: https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e github.com: https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a github.com: https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1

Credits

🔍 Chuck Woodraska Petr Viktorin Serhiy Storchaka Hugo van Kemenade Łukasz Langa Thomas Wouters Seth Larson Matt Prodani