CVE-2025-4330 is a vulnerability in the CPython tarfile module that allows an attacker to bypass extraction filters when using TarFile.extractall() or TarFile.extract() with certain filters. This enables symlink traversal outside the intended extraction directory, potentially allowing modification or overwriting of system files and file metadata. The vulnerability requires that a privileged user or process extract a malicious tar archive, limiting the attack vector. Red Hat has identified this issue in python3.13 packages included in Red Hat Hardened Images RPMs. The vulnerability is classified under CWE-22 (Path Traversal). Red Hat has not provided a patch or mitigation that meets their criteria for ease of use and deployment.

Successful exploitation can lead to unauthorized modification or overwriting of critical system files and metadata, potentially compromising system integrity and security. Because exploitation requires a privileged user or process to extract a malicious tar file, the risk is mitigated by the need for elevated privileges and user interaction. There is no indication of active exploitation in the wild. The vulnerability could allow attackers to bypass security mechanisms by altering files used for authentication or execution of code.

Red Hat has not provided an official fix or mitigation that meets their criteria for deployment and stability. Users should apply the available security update to python3.13 packages in Red Hat Hardened Images RPMs when it becomes available. Until then, avoid extracting untrusted tar archives with elevated privileges or in trusted contexts. Monitor Red Hat advisories for updates and patches related to this vulnerability.