Symlink Target Vulnerability in Python3 Package - CVE-2025-4138
Summary
ALPINE-CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. Affects python3 versions < 3.11.13-r0. Fixed in 3.11.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python3 package in Alpine Linux is a widely used implementation of the Python programming language, known for its simplicity and versatility in various applications, including web development, data analysis, and automation. This package allows developers to utilize Python's extensive libraries and frameworks. However, a vulnerability has been identified that affects the tarfile module, specifically when extracting untrusted tar archives.
Vulnerability Detail
CVE-2025-4138 allows the extraction filter to be ignored when using the tarfile module's TarFile.extractall() or TarFile.extract() methods with the filter parameter set to 'data' or 'tar'. This oversight can lead to symlink targets pointing outside the intended destination directory, potentially allowing unauthorized access to sensitive files or modification of file metadata. The vulnerability arises from a change in default behavior in Python 3.14, where the filter parameter defaults to 'data', increasing the risk for developers who rely on this new setting.
How To Fix
Minimum fixed version
3.11.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the filter parameter with the TarFile.extractall() or TarFile.extract() methods when dealing with untrusted tar archives. Instead, consider manually validating the contents of the tar file before extraction.
Conclusion
The CVE-2025-4138 vulnerability in the Python3 package poses significant risks when extracting untrusted tar archives. It is crucial to update to the patched versions or implement workarounds to mitigate potential threats. Regular monitoring of vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for python3 →
FAQ
CVE-2025-4138 is a vulnerability in the Python3 package that allows symlink targets to point outside the destination directory when extracting untrusted tar archives.
If your application uses the tarfile module to extract untrusted tar archives, it may be susceptible to unauthorized file access or modification due to this vulnerability.
Affected versions include Python3 in Alpine v3.19, v3.20, v3.21, and v3.22 prior to the specified fixed versions.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, avoid using the vulnerable extraction methods with untrusted tar files and validate their contents manually.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
