Python tarfile
CVE-2025-13462
LOW
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because attacker must control archive input; PR:L since application-level access is needed; impact limited to low integrity via type misclassification with no confidentiality or availability effect.
Primary rating from Vendor (python).
CVSS VectorVendor: python
Lifecycle Timeline
5DescriptionCVE.org
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
AnalysisAI
Python's tarfile module incorrectly applies AREGTYPE-to-DIRTYPE normalization while processing multi-block GNU extension headers (GNUTYPE_LONGNAME and GNUTYPE_LONGLINK), causing crafted tar archives to be misinterpreted relative to other tar implementations. A regular file with a long name whose intermediate path component ends in a slash can be incorrectly classified as a directory (DIRTYPE), creating a discrepancy that may undermine type-based security checks in downstream archive-processing code. No public exploit is identified, EPSS stands at 0.04% (12th percentile), and this CVE is not in CISA KEV, reflecting negligible real-world exploitation pressure at time of analysis.
Technical ContextAI
The Python tarfile module parses tar archives according to POSIX/GNU tar specifications. The old v7 tar format used AREGTYPE (\x00) for both regular files and directories, relying on a trailing slash in the entry name to distinguish directories; modern implementations normalize AREGTYPE blocks with trailing-slash names to DIRTYPE. GNU tar extended this with GNUTYPE_LONGNAME and GNUTYPE_LONGLINK header types to support names exceeding 100 characters, using follow-up header blocks that carry intermediate name fragments. The root cause (CWE-20: Improper Input Validation) is that the AREGTYPE-to-DIRTYPE normalization was applied unconditionally to every parsed header block, including these follow-up blocks. A follow-up block carrying an intermediate path component ending in a slash would satisfy the heuristic and be incorrectly normalized. The fix - confirmed by PR #143934 - introduces a dircheck parameter that disables the normalization when parsing follow-up headers (dircheck=False in _frombuf and _fromtarfile), protecting GNUTYPE_LONGNAME and GNUTYPE_LONGLINK processing paths. Affected products span all Python versions per CPE (cpe:2.3:a:python:python:*) with specific enumeration of 3.15.0 alpha1 through alpha7.
RemediationAI
Upstream fix is available via CPython pull request #143934 (https://github.com/python/cpython/pull/143934), applied across multiple branches; however, specific tagged patched release versions are not confirmed in the available data and must be verified through the Python security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/ or Ubuntu USN-8509-1 at https://ubuntu.com/security/notices/USN-8509-1. As a compensating control for applications that cannot immediately update, independently validate TarInfo.type values returned by the module against expected values before acting on them, rather than trusting the module's normalization output for security-relevant decisions. Alternatively, restrict which archives the application accepts to only internally generated or cryptographically signed archives, eliminating the attacker's ability to supply crafted input - this is the most effective mitigation without a patch but requires application-level changes.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today