CVE-2025-4435: Python TarFile Filter Bypass Vulnerability

CVE-2025-4435 Overview

CVE-2025-4435 is an improper input validation vulnerability affecting Python's tarfile module. When using TarFile.errorlevel = 0 and extracting with a filter, the documented behavior specifies that any filtered members would be skipped and not extracted. However, the actual behavior in affected versions is that the member would still be extracted despite being filtered, leading to potential security bypasses.

Critical Impact
Applications relying on tarfile filters for security-critical operations may inadvertently extract malicious archive members that should have been blocked, potentially leading to arbitrary file writes or path traversal attacks.

Affected Products

Python CPython (multiple versions)

Discovery Timeline

June 3, 2025 - CVE-2025-4435 published to NVD
June 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4435

Vulnerability Analysis

This vulnerability is classified under CWE-682 (Incorrect Calculation), stemming from a logic error in how the Python tarfile module processes extraction filters when errorlevel is set to 0. The filter mechanism was designed to provide a security layer allowing developers to control which archive members get extracted based on custom criteria. However, the implementation flaw causes filtered members to be extracted anyway when error suppression is enabled.

The vulnerability is particularly concerning for applications that process untrusted tar archives and rely on filters to prevent extraction of potentially dangerous files such as symbolic links pointing outside the destination directory or files with path traversal components. The filter bypass can be exploited remotely via network-accessible file processing, requiring no authentication or user interaction.

Root Cause

The root cause lies in incorrect error handling logic within the tarfile module's extraction routine. When TarFile.errorlevel = 0 is configured, the module's design intent is to silently ignore non-critical errors while still respecting security filters. However, the implementation incorrectly treats filter rejections as suppressible errors rather than mandatory security controls, causing filtered members to be extracted instead of skipped.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious tar archive containing members that should be blocked by extraction filters (such as symlinks pointing outside the extraction directory, or files with path traversal sequences). When a vulnerable application processes this archive with errorlevel = 0 and a security filter, the malicious members bypass the filter and get extracted anyway.

This can lead to:

Arbitrary file writes outside the intended extraction directory
Symbolic link attacks allowing access to sensitive files
Overwriting critical system or application files

The patch introduces a new LinkFallbackError exception and modifies os.path.realpath() behavior to properly handle path normalization with a new ALLOW_MISSING strict mode:

text

    Raised to refuse extracting a symbolic link pointing outside the destination
    directory.
 
+.. exception:: LinkFallbackError
+
+   Raised to refuse emulating a link (hard or symbolic) by extracting another
+   archive member, when that member would be rejected by the filter location.
+   The exception that was raised to reject the replacement member is available
+   as :attr:`!BaseException.__context__`.
+
+   .. versionadded:: next
+
 
 The following constants are available at the module level:

Source: GitHub Commit 3612d8

The patch also enhances os.path.realpath() with improved error handling for path resolution:

text

-   If a path doesn't exist or a symlink loop is encountered, and *strict* is
-   ``True``, :exc:`OSError` is raised. If *strict* is ``False`` these errors
-   are ignored, and so the result might be missing or otherwise inaccessible.
+   By default, the path is evaluated up to the first component that does not
+   exist, is a symlink loop, or whose evaluation raises :exc:`OSError`.
+   All such components are appended unchanged to the existing part of the path.
+
+   Some errors that are handled this way include "access denied", "not a
+   directory", or "bad argument to internal function". Thus, the
+   resulting path may be missing or inaccessible, may still contain
+   links or loops, and may traverse non-directories.
+
+   This behavior can be modified by keyword arguments:
+
+   If *strict* is ``True``, the first error encountered when evaluating the path is
+   re-raised.
+   In particular, :exc:`FileNotFoundError` is raised if *path* does not exist,
+   or another :exc:`OSError` if it is otherwise inaccessible.
+
+   If *strict* is :py:data:`os.path.ALLOW_MISSING`, errors other than
+   :exc:`FileNotFoundError` are re-raised (as with ``strict=True``).
+   Thus, the returned path will not contain any symbolic links, but the named
+   file and some of its parent directories may be missing.

Source: GitHub Commit 3612d8

Detection Methods for CVE-2025-4435

Indicators of Compromise

Unexpected files appearing outside designated extraction directories after tar archive processing
Symbolic links created pointing to sensitive system locations (e.g., /etc/passwd, /etc/shadow)
File modification timestamps in protected directories coinciding with tar extraction operations
Log entries showing tarfile operations with errorlevel = 0 processing untrusted archives

Detection Strategies

Monitor Python applications for tarfile extraction operations using errorlevel = 0 configuration
Implement file integrity monitoring on directories where tar archives are extracted
Audit application code for tarfile usage patterns that combine filters with errorlevel = 0
Deploy runtime application security testing to detect filter bypass attempts

Monitoring Recommendations

Enable comprehensive logging for all file extraction operations in Python applications
Set up alerts for file creation or modification outside expected extraction paths
Monitor for symbolic link creation during archive extraction processes
Review application dependencies for vulnerable Python versions

How to Mitigate CVE-2025-4435

Immediate Actions Required

Update Python to a patched version that addresses the tarfile filter bypass
Audit applications using tarfile module with errorlevel = 0 and security filters
Consider temporarily using errorlevel = 1 or errorlevel = 2 to ensure filter violations raise exceptions
Implement additional validation layers for tar extraction operations handling untrusted archives

Patch Information

The Python Software Foundation has released patches across multiple Python version branches. Security fixes are available through the following commits:

For full details, see the Python Security Announcement and GitHub Issue #135034.

Workarounds

Set TarFile.errorlevel = 1 or higher to ensure filter rejections raise exceptions instead of being bypassed
Implement manual pre-extraction validation of tar archive contents before extraction
Use isolated extraction directories with strict filesystem permissions to limit impact of unintended extractions
Consider using alternative archive handling libraries with stronger security guarantees for untrusted input

bash

# Configuration example - Use errorlevel=1 instead of 0
# In Python code, replace:
# tar.errorlevel = 0
# With:
# tar.errorlevel = 1  # Ensures filter violations raise exceptions

# Verify Python version after update
python3 --version

# Check for vulnerable tarfile usage patterns in codebase
grep -r "errorlevel.*=.*0" --include="*.py" /path/to/application