TI-2024-11791 CVE-2024-12718 · GHSA-2pg8-h2j6-28xm
Bypass extraction filter to modify file metadata outside extraction directory
Priority MEDIUM 63
Allows modifying some file metadata (e.g.
Vulnerabilities
5 records
Advisory: Python Software Foundation CPython — mail.python.org/archives/list/[email protected]/… Clear all filters
TI-2025-03954 CVE-2025-4435 · GHSA-p72v-37h5-753v
Tarfile extracts filtered members when errorlevel=0
Priority MEDIUM 40
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted.
TI-2025-03675 CVE-2025-4138 · GHSA-4g4g-fqw4-prp2
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Priority MEDIUM 42
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
TI-2025-03859 CVE-2025-4330 · GHSA-68pj-xrp5-vccj
Extraction filter bypass for linking outside extraction directory
Priority MEDIUM 41
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
TI-2025-04033 CVE-2025-4517 · GHSA-6r6c-684h-9j7p
Arbitrary writes via tarfile realpath overflow
Priority MEDIUM 51
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".