CVE-2025-4435: Vulnerability in Python Software Foundation CPython
CVE-2025-4435 is a vulnerability in the Python Software Foundation's CPython implementation affecting versions 3.10.0 through 3.14.0a1. The issue involves the TarFile module's errorlevel setting. When TarFile.errorlevel is set to 0 and extraction is performed with a filter, the expected behavior is to skip filtered members. However, in affected versions, these members are still extracted, contrary to documented behavior.
AI Analysis
Technical Summary
This vulnerability in CPython's TarFile module arises because setting errorlevel to 0 does not prevent extraction of filtered members as intended. Instead of skipping these members, the module extracts them, violating the documented behavior. This could lead to unintended extraction of archive members that should have been skipped based on the filter criteria. The issue affects CPython versions 3.10.0, 3.11.0, 3.12.0, 3.13.0, and 3.14.0a1. The CVSS v3.1 score is 7.5, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
The vulnerability allows unintended extraction of archive members that should have been skipped according to the filter and errorlevel settings. This can lead to integrity violations where unauthorized or unexpected files are extracted, potentially causing application or system behavior to deviate from expectations. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
No official patch or fix is currently documented or linked. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should be cautious when using TarFile.errorlevel = 0 with filters and consider alternative extraction methods or additional validation of extracted content.
CVE-2025-4435: Vulnerability in Python Software Foundation CPython
Description
CVE-2025-4435 is a vulnerability in the Python Software Foundation's CPython implementation affecting versions 3.10.0 through 3.14.0a1. The issue involves the TarFile module's errorlevel setting. When TarFile.errorlevel is set to 0 and extraction is performed with a filter, the expected behavior is to skip filtered members. However, in affected versions, these members are still extracted, contrary to documented behavior.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in CPython's TarFile module arises because setting errorlevel to 0 does not prevent extraction of filtered members as intended. Instead of skipping these members, the module extracts them, violating the documented behavior. This could lead to unintended extraction of archive members that should have been skipped based on the filter criteria. The issue affects CPython versions 3.10.0, 3.11.0, 3.12.0, 3.13.0, and 3.14.0a1. The CVSS v3.1 score is 7.5, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
The vulnerability allows unintended extraction of archive members that should have been skipped according to the filter and errorlevel settings. This can lead to integrity violations where unauthorized or unexpected files are extracted, potentially causing application or system behavior to deviate from expectations. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
No official patch or fix is currently documented or linked. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should be cautious when using TarFile.errorlevel = 0 with filters and consider alternative extraction methods or additional validation of extracted content.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- PSF
- Date Reserved
- 2025-05-08T15:05:11.874Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 683f0dc3182aa0cae27ff441
Added to database: 06/03/2025, 14:59:15 UTC
Last enriched: 08/07/2026, 14:59:49 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 486
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.