Search: CVE-2025-4138

CVE-2025-4138 is a path traversal vulnerability in the Python tarfile module that allows the extraction filter to be bypassed, enabling symlink targets to point outside the intended extraction directory and permitting modification of some file metadata. This affects usage of TarFile.extractall() or TarFile.extract() when using the filter parameter set to "data" or "tar". The default filter value changed to "data" starting with Python 3.14, so code relying on this default is also affected. This vulnerability does not significantly impact source distribution installations, which already allow arbitrary code execution during build.