CVE-2025-4517 Arbitrary writes via tarfile realpath overflow

🗓️ 03 Jun 2025 12:58:50Reported by PSFType

CVE-2025-4517 allows arbitrary writes via tarfile extraction filter, affecting Python 3.12 and later.

Reporter	Title	Published	Views	Family All 367
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal in Python [CVE-2025-4517]	17 Dec 202514:16	–	ibm
IBM Security Bulletins	Security Bulletin: multiple vulnerabilities in IBM Spectrum Symphony with Requests and urlib3	23 Oct 202520:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Defender: Data Protect critical vulnerabilities resolved in release Defender 2.1.0/Data Protect 7.3	10 Dec 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: AIX/VIOS is affected by arbitrary code execution (CVE-2025-47273, CVE-2025-4330, CVE-2024-12718, CVE-2025-4138, CVE-2025-4517) due to Python	20 Aug 202515:03	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities due to libxml2, python3, pam and glibc packages shipped with IBM CICS TX Standard.	12 Aug 202511:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities discovered in RedHat UBI as shipped with IBM Security Verify Directory Server Container	8 Aug 202517:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana is vulnerable to Path Traversal in python	31 Jul 202514:16	–	ibm
GithubExploit	Exploit for CVE-2025-4517	15 Feb 202622:09	–	githubexploit
GithubExploit	HTB-WingData-Writeup	27 Apr 202615:17	–	githubexploit
GithubExploit	Exploit for CVE-2025-4517	20 Feb 202602:08	–	githubexploit

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "tarfile"
    ],
    "product": "CPython",
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.10.18",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.11.0",
        "lessThan": "3.11.13",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.12.0",
        "lessThan": "3.12.11",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.13.0",
        "lessThan": "3.13.4",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.14.0a1",
        "lessThan": "3.14.0b3",
        "status": "affected",
        "versionType": "python"
      }
    ]
  }
]

Source	Link
github	www.github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
gist	www.gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
github	www.github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
github	www.github.com/python/cpython/pull/135037
github	www.github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01
github	www.github.com/python/cpython/issues/135034
github	www.github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a
github	www.github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
github	www.github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
github	www.github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9