🛡️ CVE-2025-4330 — libpython

🟠 CVSS 8.0 — High ✅ No Known Exploit NVD

8.0

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Extraction filter bypass for linking outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.

You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network — reachable from anywhere that can route to the service.
Attack complexity: Low — the attack works reliably, with no preparation.
Privileges required: None — an unauthenticated stranger can try it.
User interaction: None — nobody has to be tricked into anything.
Scope: Unchanged — the damage stays inside the vulnerable component.
Confidentiality impact: None.
Integrity impact: High — total loss, or loss the attacker controls.
Availability impact: None.

Affected software

CVE-2025-4330 is recorded against 4 packages.

libpython
python
python-min
unknown

Timeline and source

Published on 11 August 2025. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

gist.github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
mail.python.org (Web)
nvd.nist.gov (Web)

Other advisories for this package

libpython has other advisories on record. If you are patching this one, these are worth checking on the same host:

CVE-2026-15308 (8.0 High, published 19 Aug 2026)
CVE-2026-3087 (5.0 Medium, published 19 Aug 2026)
CVE-2026-18503 (2.0 Low, published 17 Aug 2026)
CVE-2026-6879 (2.0 Low, published 17 Aug 2026)
CVE-2026-0864 (5.0 Medium, published 30 Jul 2026)
CVE-2026-11972 (8.0 High, published 30 Jul 2026)
CVE-2026-11940 (8.0 High, published 30 Jul 2026)
CVE-2026-4360 (2.0 Low, published 8 Jul 2026)

CVE-2025-4330 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Alpine — ALPINE-CVE-2025-4330 BellSoft — BELL-CVE-2025-4330 Debian — DEBIAN-CVE-2025-4330 Ubuntu — UBUNTU-CVE-2025-4330

Details

Severity HIGH

CVSS Score 8.0

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE N/A

Public Exploit ✅ No

Source NVD

Published 2025-08-11

Updated 2026-08-20

Modified 2025-08-11

Fix URL N/A

Affected Packages

Software	From version	Fixed in
libpython	—	—
python	—	—
python-min	—	—
unknown	—	—

References

WEB https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f

WEB https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da

WEB https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9

WEB https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a

WEB https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e

WEB https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a

WEB https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a

WEB https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01

WEB https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1

WEB https://github.com/python/cpython/issues/135034

WEB https://github.com/python/cpython/pull/135037

WEB https://mail.python.org/archives/list/[email protected]/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

WEB https://nvd.nist.gov/vuln/detail/CVE-2025-4330

🔗 NVD 🔗 Mitre

Similar Threats

Site Security Check

Is libpython part of your stack?

CVE-2025-4330 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

🛡️ CVE-2025-4330 — libpython

Description

How this vulnerability can be exploited

CVSS metrics in full

Affected software

Timeline and source

References

Other advisories for this package

CVE-2025-4330 on other distributions

Is libpython part of your stack?

Browse related advisories

Company

Resources

Services

Trusted

Subscribe