CVE-2025-4330

Deeper analysis

The vulnerability CVE-2025-4330 is a path traversal flaw (CWE-22) in Python's tarfile module that permits the configured extraction filter to be bypassed. It affects TarFile.extractall() and TarFile.extract() calls that specify filter="data" or filter="tar", including the new default filter behavior introduced in Python 3.14; the result allows symlink targets to escape the destination directory and permits modification of selected file metadata.

An attacker who can supply a malicious tar archive can exploit the issue over the network without authentication or user interaction whenever a victim application extracts the archive using the affected filters. Successful exploitation grants the ability to write files outside the intended directory and alter metadata, producing high-integrity impact as reflected in the CVSS 7.5 score.

Official mitigation guidance and patches are documented in the referenced CPython commits and the tarfile extraction-filter documentation; users should apply the updates or avoid the vulnerable filter settings when handling untrusted archives. The advisory notes that source-distribution tarballs are not significantly affected because they already permit arbitrary code execution at build time, yet it still recommends avoiding installation of distributions that contain suspicious links. The associated EPSS score has remained flat at 0.0101 with no material increase.