Python 3.14's default data filter and the CVE-2025-4517 trap
Overview
Python 3.14 changed tar extraction so the data filter is used by default. That change is a useful safety improvement, but CVE-2025-4517 shows why a default filter can still fail against a crafted path.
The vulnerability allows arbitrary filesystem writes outside the extraction directory. It has a CVSS 3.1 base score of 9.4. The affected path is used by applications that process untrusted archives and by code that relies on the new default without checking the interpreter's patch level.
Mechanism
The extraction check calls os.path.realpath to determine the effective destination. A long series of symlinks can make the resolved path exceed the platform's path limit. When realpath fails, the filter continues with a path that does not reflect the true destination. A later member can then write outside the extraction root.
The Python project fixed the logic in the same security change set that normalized link targets and introduced os.path.realpath(strict="allow_missing") for the extraction path. The important condition is not the filter name alone; it is whether the runtime has the corrected resolution behavior.
Impact
An attacker who can supply an archive to a vulnerable worker can overwrite files writable by that worker. The result may be configuration corruption, data loss or a foothold for code execution through a file consumed by another process. The issue does not establish that every Python 3.14 process is vulnerable.
Affected products and scope
The reviewed fixed releases are 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 and 3.14.0b1. Python 3.14.0b1 is the first fixed pre-release in that branch. Any later release should be used according to the branch's support policy.
Exposure context
ZoomEye reported 60035 Python application-fingerprint matches for app="Python" and 0 results for vul.cve="CVE-2025-4517". The count is useful for inventory, not as evidence that an asset exposes an archive service.
Remediation
Upgrade the interpreter used by the archive path, including embedded and containerized builds. Explicitly test extraction with a crafted long-link archive after deployment. If the update cannot be applied immediately, reject dangerous link targets, inspect archive members and isolate the extraction directory.
