Symlink Vulnerability in Python 3.12 and 3.13 Packages
Summary
UBUNTU-CVE-2025-4330: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. Affects python3.12 versions < 3.12.3-1ubuntu0.7. Fixed in 3.12.3-1ubuntu0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, python3.12 and python3.13, are implementations of Python 3.12 and 3.13, respectively, on Ubuntu systems. These packages provide essential tools for developers to create and run Python applications. However, a recently discovered vulnerability allows for the extraction filter to be ignored when using the tarfile module, posing a risk to file integrity and security.
Vulnerability Detail
The vulnerability, identified as CVE-2025-4330, allows the tarfile extraction filter to be bypassed, enabling symlink targets to point outside the intended destination directory. This can lead to unauthorized modification of file metadata and potential security breaches when extracting untrusted tar archives. The issue arises when using TarFile.extractall() or TarFile.extract() with the filter parameter set to 'data' or 'tar'. Notably, Python 3.14 and later versions have changed the default filter behavior, which may inadvertently expose users to this vulnerability if they rely on the new default settings.
How To Fix
Minimum fixed version
3.12.3-1ubuntu0.7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the tarfile module to extract untrusted tar archives, especially with the filter parameter set to 'data' or 'tar'. Instead, consider using alternative methods for extracting archives or ensure that the archives are from trusted sources.
Conclusion
The CVE-2025-4330 vulnerability in Python 3.12 and 3.13 packages poses significant risks when extracting untrusted tar archives. Users are advised to update their packages to the latest patched versions to mitigate these risks. For those unable to update immediately, alternative extraction methods should be employed to ensure security.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2025-4330 is a vulnerability in the Python tarfile module that allows symlink targets to point outside the destination directory, potentially compromising file integrity.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The risks include unauthorized access to files, modification of file metadata, and potential security breaches when extracting untrusted tar archives.
Yes, patched versions of the affected packages are available. Users should update to python3.12 version 3.12.3-1ubuntu0.7 or python3.13 version 3.13.3-1ubuntu0.2.
If immediate updates are not possible, avoid using the tarfile module for untrusted archives and consider using alternative extraction methods.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
