CVE-2025-4435

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

Credits

Chuck Woodraska

Petr Viktorin

Serhiy Storchaka

Hugo van Kemenade

Łukasz Langa

Thomas Wouters

Seth Larson

Matt Prodani

References

https://github.com/python/cpython/issues/135034

https://github.com/python/cpython/pull/135037

https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a

https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a

https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da

https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01

https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9

https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e

https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a

https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1