Symlink Target Vulnerability in Jython and Python Packages
Summary
CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. Affects python3 across 9 version ranges.
< 3.11.13-r0
< 9c1110ef6652687d7c55f590f909720eddde965a
< 9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
< 19de092debb3d7e832e5672cc2f7b788d35951da
< 3612d8f51741b11f36f8fb0494d79086bac9390a
< 4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
< 28463dba112af719df1e8b0391c46787ad756dd9
< aa9eb5f757ceff461e6e996f12c89e5d9b583b01
< dd8f187d0746da151e0025c51680979ac5b4cfb1
Fixed in 3.11.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jython package is an implementation of the Python programming language designed to run on the Java platform. It allows seamless integration of Java and Python code. The Python packages mentioned, including python2.7, python3.11, and python3.13, are widely used for various applications, providing extensive libraries and functionalities. However, a vulnerability has been identified that affects the tarfile module in Python versions 3.12 and later, which can lead to security risks when extracting untrusted tar archives.
Vulnerability Detail
The vulnerability (CVE-2025-4138) allows the extraction filter in the tarfile module to be ignored, enabling symlink targets to point outside the intended destination directory. This can lead to unauthorized access and modification of file metadata. The issue arises when using the TarFile.extractall() or TarFile.extract() methods with a filter parameter set to 'data' or 'tar'. Only Python versions 3.12 and later are affected, and for Python 3.14 or later, the default filter value has changed to 'data', which may inadvertently expose users to this vulnerability.
How To Fix
Minimum fixed version
3.11.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the TarFile.extractall() or TarFile.extract() methods with the filter parameter set to 'data' or 'tar' when extracting untrusted tar archives. Instead, consider validating the contents of the tar archive before extraction.
Conclusion
The vulnerability CVE-2025-4138 poses a significant risk to users of the Jython and Python packages when extracting untrusted tar archives. It is crucial to update affected packages to their patched versions and implement workarounds to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for python3 →
FAQ
CVE-2025-4138 is a vulnerability that allows symlink targets to be extracted outside the intended directory when using the tarfile module in Python.
Only Python versions 3.12 and later are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, avoid using the vulnerable extraction methods with untrusted tar archives until you can apply the necessary updates.
While it does not significantly affect the installation of source distributions, it poses a risk of unauthorized access and modification of file metadata, making it important to address.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
