CVE-2025-4138

CVE-2025-4138 Python-Tarfile-Modul Verzeichnis-Traversal-Schwachstelle mit Overflow über Verzeichnisgrenzen hinweg Auswirkung : Privilegienerweiterung Funktionsweise : Die TarFile.extractall- und TarFile.extract-Methoden von Python unterstützen ein Feature, mit dem ein Filter gesetzt werden kann,...

CVE-2025-4138-4517-POC

CVE-2025-4138 / CVE-2025-4517 Bypass del filtro di tarfile Python tramite escape dei symlink con PATHMAX Scrittura arbitraria di file tramite estrazione confilter="data" / filter="tar" Indice Panoramica Dettagli della vulnerabilità Com...

CVE-2025-4138_tarfile_filter_bypass

CVE-2025-4138 — Bypass del filtro filter="data" di Python tarfile Scrittura arbitraria di file al di fuori della directory di estrazione tramite una catena di symlink PATHMAX. Versioni interessate Python 3.12.0 – 3.12.10 Python 3.13.0 – 3.13.3 Corretto in 3.12.11 / 3.13.4 Crediti: Segnalazione:...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Bypass del filtro "data" di Python tarfile PoC Vulnerabilità di path traversal nel modulo tarfile di Python, che interessa le versioni dalla 3.8.0 alla 3.13.1. La sandbox filter="data" — pensata per prevenire estrazioni non sicure — può essere bypassata creando percorsi che supera...

CVE-2025-4138-poc

CVE-2025-4138 Generatore Auto-Sudo Uno script Python per generare un archivio tar malevolo che sfrutta CVE-2025-4138 / CVE-2025-4517 Path Traversal tramite troncamento di PATHMAX. Lo sfruttamento riuscito di questa vulnerabilità consente a un attaccante di aggirare i filtri di estrazione di tarfi...

CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 è una vulnerabilità nel modulo tarfile di Python che consente scritture arbitrarie di file al di fuori della directory di estrazione quando si estraggono archivi tar non attendibili. Il problema si verifica quando si utilizza TarFile.extract o TarFile.extractall co...

CVE-2007-4559-lab

CVE-2007-4559 — TarSlip: اجتياز المسار عبر 15 عامًا للاستخدام التعليمي فقط. يستغل هذا المختبر عن قصد ثغرات نظام الملفات داخل حاويات Docker معزولة. لا تشغّله على أي نظام يحتوي بيانات حساسة أو في بيئات الإنتاج. مختبر Docker مستقل بذاته يوضح CVE-2007-4559 — ثغرة «TarSlip» سيئة السمعة في وحدة tarfile...

CVE-2007-4559

PoC o Exploit per CVE-2007-4559 Un archivio TAR malevolo può includere percorsi di file come ../../../../etc/passwd, che tentano di "salire" fuori dalla cartella di estrazione prevista. Se uno script Python usa tarfile.extract o extractall senza controllare i percorsi dei file, decomprimerà i fil...

CVE-2025-4517-POC

CVE-2025-4517 Exploit HINWEISE Dieser Exploit und die Beschreibung wurden von KI erstellt. Wenn du einen Fehler oder ein Problem findest, lass es mich bitte wissen! Dieser Exploit wurde getestet und funktioniert nachweislich. Vielen Dank! Übersicht Dieser Exploit nutzt CVE-2025-4517 aus, eine...

BIT-PYTHON-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...

BIT-PYTHON-MIN-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...

CVE-2025-4517-POC-Sudoers

CVE-2025-4517 - POC zum Hinzufügen eines Benutzers zu sudoers Dieses Skript ist eine weaponisierte Version der im Google Security Research Advisory: https://github.com/google/security-research/security/advisories/GHSA-hgqp-3mmf-7h8f veröffentlichten Forschung. Während die ursprüngliche Forschung...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile: Scrittura Arbitraria di File tramite Path Traversal CVE-2025-4517 CVSS 9.4 – Critico Una vulnerabilità nel modulo tarfile di Python che consente la scrittura arbitraria di file al di fuori della directory di estrazione quando si utilizza TarFile.extractall o...

CVE-2025-4517-tarfile-PATH_MAX-bypass

CVE-2025-4517 / CVE-2025-4330 — Bypass del filtro dati di Python tarfile tramite overflow di PATHMAX Autore: 0xDTC CVE: CVE-2025-4517 / CVE-2025-4330 Avviso: GHSA-6r6c-684h-9j7p Correzione CPython: PR 135037 Panoramica tarfile.extractallfilter="data" di Python dovrebbe estrarre archivi tar in mod...

python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode

A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' mode='r|', the module does not properly handle the end-of-file EOF condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service DoS f...

python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode

A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' mode='r|', the module does not properly handle the end-of-file EOF condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service DoS f...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

CVE-2026-4360

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...