PyPath-Escape-CVE-2025-4517-Exploit-Research

🛡️ PyPath-Escape: 高级 PATHMAX 绕过工具包 作者: Beriwalarohit 研究目标: CVE-2025-4517 / CVE-2025-4138 ██████╗ ███████╗██████╗ ██╗██╗ ██╗ █████╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝██╔══██╗██║██║ ██║██╔══██╗██║ ██╔══██╗██╔══██╗ ██████╔╝█████╗ ██████╔╝██║██║ █╗ ██║███████║██║ ███████║██████╔╝ ██╔══██╗██╔══╝...

CVE-2025-4138_tarfile_filter_bypass

CVE-2025-4138 — Bypass del filter="data" de Python tarfile Escritura arbitraria de archivos fuera del directorio de extracción mediante una cadena de symlinks PATHMAX. Versiones afectadas Python 3.12.0 – 3.12.10 Python 3.13.0 – 3.13.3 Corregido en 3.12.11 / 3.13.4 Crédito: Reportero: Caleb Brown...

CVE-2025-4517-tarfile-PATH_MAX-bypass

CVE-2025-4517 / CVE-2025-4330 — Python tarfile 数据过滤器绕过（通过 PATHMAX 溢出） 作者: 0xDTC CVE 编号: CVE-2025-4517 / CVE-2025-4330 安全通告: GHSA-6r6c-684h-9j7p CPython 修复: PR 135037 概述 Python 的 tarfile.extractallfilter="data" 本应通过阻止路径遍历（绝对路径、.. 序列以及逃逸出目标目录的符号链接）来安全地提取 tar 归档。然而，os.path.realpathstrict=False 中的一个...

CVE-2025-4138-4517-POC

CVE-2025-4138 / CVE-2025-4517 Omisión del filtro de Python tarfile mediante escape de enlace simbólico PATHMAX Escritura arbitraria de archivos mediante extracción confilter="data" / filter="tar" Tabla de contenidos Resumen Detalles de la...

CVE-2025-4138

CVE-2025-4138 Vulnerabilidad de recorrido de directorios en el módulo Python Tarfile con desbordamiento que cruza el directorio Impacto : Escalada de privilegios Funcionamiento : Los métodos TarFile.extractall y TarFile.extract de Python admiten una funcionalidad que permite establecer un filtro...

CVE-2025-4517-POC-Sudoers

CVE-2025-4517 - POC agregando usuario a sudoers Este script es una versión armada de la investigación publicada en el Aviso de Investigación de Seguridad de Google: https://github.com/google/security-research/security/advisories/GHSA-hgqp-3mmf-7h8f Mientras que la investigación original demuestra...

CVE-2025-4138-POC

CVE-2025-4138 - Bypass de PATHMAX en tarfile de Python PoC Autor: d3vn0mi / \ \ / / | | / \ | | | | || | / | | \ V /| | | | | | | \ | | || || / \ | | | | | ||/ /| || / / || | , | | || || ||/|/ |||/ // CVE-2025-4138 :: Python tarfile PATHMAX Bypass Author: d3vn0mi Resumen Un exploit de prueba...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" Bypass PoC Vulnerabilidad de Path Traversal en el módulo tarfile de Python que afecta a las versiones 3.8.0 hasta 3.13.1. El sandbox filter="data" — diseñado para evitar extracciones no seguras — puede ser evadido creando rutas que exceden PATHMAX 4096...

CVE-2025-4138-poc

CVE-2025-4138 Generador Auto-Sudo Un script de Python para generar un archivo tar malicioso que explota CVE-2025-4138 / CVE-2025-4517 Recorrido de rutas mediante truncamiento de PATHMAX. Explotar con éxito esta vulnerabilidad permite a un atacante eludir los filtros de extracción de tarfile y...

CVE-2026-58106

CodeChecker through 6.28.2 contains an incomplete fix for CVE-2025-40843. In ldlogger-tool-gcc.c:129 , the bounded helper safe_strcpy() is called with the full PATH_MAX size, but the destination is fullPath + 2 , leaving only 4094 bytes. Because safe_strcpy() is a strncpy() that NUL-pads to the f...

CVE-2026-58106 Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

CVE-2026-58106 Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

EUVD-2016-1713

Malware in sbrugna...

EUVD-2024-52029

Malicious code in bioql PyPI...

CVE-2024-53685

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATHMAX If the full path to be built by cephmdscbuildpath happens to be longer than PATHMAX, then this function will enter an endless retry loop, effectively blocking the whole task. Most of the...

CVE-2024-53685

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATHMAX If the full path to be built by cephmdscbuildpath happens to be longer than PATHMAX, then this function will enter an endless retry loop, effectively blocking the whole task. Most of the...

CVE-2024-53685

CVE-2024-53685 concerns the Linux kernel Ceph path construction: when the full path built by ceph_mdsc_build_path() exceeds PATH_MAX, the function enters an endless retry loop, effectively DoS-ing the system. The description notes the fix is to remove the retry and fail with ENAMETOOLONG instead,...

CVE-2024-53685

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATHMAX If the full path to be built by cephmdscbuildpath happens to be longer than PATHMAX, then this function will enter an endless retry loop, effectively blocking the whole task. Most of the...

CVE-2024-53685 ceph: give up on paths longer than PATH_MAX

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATHMAX If the full path to be built by cephmdscbuildpath happens to be longer than PATHMAX, then this function will enter an endless retry loop, effectively blocking the whole task. Most of the...

CVE-2024-53685: Loop with Unreachable Exit Condition

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATHMAX If the full path to be built by cephmdscbuildpath happens to be longer than PATHMAX, then this function will enter an endless retry loop, effectively blocking the whole task. Most of the...