Symlink Target Vulnerability in Jython and Python Packages
Summary
CVE-2025-4330: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. Affects python3 across 9 version ranges.
< 3.11.13-r0
< 9c1110ef6652687d7c55f590f909720eddde965a
< 9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
< 19de092debb3d7e832e5672cc2f7b788d35951da
< 3612d8f51741b11f36f8fb0494d79086bac9390a
< 4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
< 28463dba112af719df1e8b0391c46787ad756dd9
< aa9eb5f757ceff461e6e996f12c89e5d9b583b01
< dd8f187d0746da151e0025c51680979ac5b4cfb1
Fixed in 3.11.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jython is an implementation of the Python programming language designed to run on the Java platform. It allows seamless integration of Java and Python code. The tarfile module in Python is used for reading and writing tar archive files. This vulnerability affects the tarfile module's extraction filters, which can be exploited to manipulate file metadata and symlink targets during the extraction of untrusted tar archives.
Vulnerability Detail
The vulnerability (CVE-2025-4330) allows the extraction filter in the tarfile module to be bypassed, enabling symlink targets to point outside the intended destination directory. This can lead to unauthorized access to sensitive files or modification of file metadata. The issue arises when using TarFile.extractall() or TarFile.extract() with the filter parameter set to 'data' or 'tar'. Only Python versions 3.12 and later are affected, with a notable change in Python 3.14 where the default filter value changed to 'data'. This vulnerability does not significantly impact the installation of source distributions, but caution is advised when handling untrusted archives.
How To Fix
Minimum fixed version
3.11.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the filter parameter with TarFile.extractall() or TarFile.extract() when extracting untrusted tar archives. Instead, consider extracting archives in a controlled environment where symlink manipulation is restricted.
Conclusion
The CVE-2025-4330 vulnerability poses a significant risk to users of the tarfile module in Python and Jython. It is crucial to update affected packages and exercise caution when handling untrusted tar archives. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3 →
FAQ
CVE-2025-4330 is a vulnerability in the tarfile module of Python that allows symlink targets to be manipulated, potentially leading to unauthorized file access.
Only Python versions 3.12 and later are affected by this vulnerability, with specific changes in behavior starting from Python 3.14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, avoid using the tarfile extraction methods with untrusted archives as a temporary workaround.
While this vulnerability does not significantly affect the installation of source distributions, caution is advised when evaluating and installing them.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
