CVE-2025-13462

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13462", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2025-11-19T22:05:07.578Z", "datePublished": "2026-03-12T17:59:26.620Z", "dateUpdated": "2026-08-13T00:30:19.927Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"version": "0", "lessThan": "3.10.21", "status": "affected", "versionType": "python"}, {"version": "3.11.0", "lessThan": "3.11.16", "status": "affected", "versionType": "python"}, {"version": "3.12.0", "lessThan": "3.12.14", "status": "affected", "versionType": "python"}, {"version": "3.13.0", "lessThan": "3.13.13", "status": "affected", "versionType": "python"}, {"version": "3.14.0", "lessThan": "3.14.4", "status": "affected", "versionType": "python"}, {"version": "3.15.0a1", "lessThan": "3.15.0a8", "status": "affected", "versionType": "python"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations."}], "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-08-13T00:30:19.927Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/python/cpython/pull/143934"}, {"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/141707"}, {"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084"}], "source": {"discovery": "UNKNOWN"}, "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling", "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:09:23.808172Z", "id": "CVE-2025-13462", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:09:51.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13462", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T19:09:23.808172Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:08:36.509Z"}}], "cna": {"title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["tarfile"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.21", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.16", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.14", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.13", "versionType": "python"}, {"status": "affected", "version": "3.14.0", "lessThan": "3.14.4", "versionType": "python"}, {"status": "affected", "version": "3.15.0a1", "lessThan": "3.15.0a8", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/python/cpython/pull/143934", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/issues/141707", "tags": ["issue-tracking"]}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.", "supportingMedia": [{"type": "text/html", "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.", "base64": false}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-08-13T00:30:19.927Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13462", "state": "PUBLISHED", "dateUpdated": "2026-08-13T00:30:19.927Z", "dateReserved": "2025-11-19T22:05:07.578Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2026-03-12T17:59:26.620Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.10.21", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.11.16", "status": "affected", "version": "3.11.0", "versionType": "python"}, {"lessThan": "3.12.14", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.13", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.4", "status": "affected", "version": "3.14.0", "versionType": "python"}, {"lessThan": "3.15.0a8", "status": "affected", "version": "3.15.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "74460139-CF2A-457B-82B4-7B655FB576B1", "versionEndExcluding": "3.13.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA3B34C3-1E02-4674-8370-0DD4D24DBE58", "versionEndExcluding": "3.14.4", "versionStartIncluding": "3.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations."}, {"lang": "es", "value": "El m\u00f3dulo 'tarfile' seguir\u00eda aplicando la normalizaci\u00f3n de bloques AREGTYPE (\\x00) a DIRTYPE, incluso al procesar un miembro de m\u00faltiples bloques como GNUTYPE_LONGNAME o GNUTYPE_LONGLINK. Esto podr\u00eda resultar en un archivo tar manipulado siendo malinterpretado por el m\u00f3dulo tarfile en comparaci\u00f3n con otras implementaciones."}], "id": "CVE-2025-13462", "lastModified": "2026-08-13T01:16:50.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13462", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:09:23.808172Z", "version": "2.0.3"}}]}, "published": "2026-03-12T18:16:21.397", "references": [{"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084"}, {"source": "cna@python.org", "tags": ["Issue Tracking"], "url": "https://github.com/python/cpython/issues/141707"}, {"source": "cna@python.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python/cpython/pull/143934"}, {"source": "cna@python.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-434"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.15.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python"}], "analysis": {"en": {"generated_at": "2026-03-18T14:36:42.101248+00:00", "value": {"mitigation_remediation": ["Verify the Python version you are running against the fix commit (42d754e) and any releases that incorporate it.", "If a patched Python release is available, upgrade to that version or apply the relevant security update.", "In the interim, restrict the extraction of tar archives to files from trusted sources and validate member names before extraction to prevent directory traversal or accidental overwrites."], "summary": {"action": "Assess", "impact": "Improper tar archive extraction leading to potential directory misinterpretation"}, "threat_synthesis": {"affected_systems": "Affected product: Python Software Foundation CPython (specifically the tarfile module). The exposure applies to any Python installation that includes the tarfile module before the fix present in the referenced commit (42d754e). No specific version range is listed in the data; thus any CPython release prior to the patch that processes these GNU tar types is potentially impacted.", "description_and_impact": "The vulnerability resides in Python's tarfile module, where it incorrectly normalizes AREGTYPE (\\x00) blocks to DIRTYPE during processing of GNUTYPE_LONGNAME or GNUTYPE_LONGLINK entries. This flaw means a crafted tar archive could be misinterpreted by the module when compared to other implementations, potentially resulting in unexpected file extraction paths or data corruption. The weakness aligns with CWE-20 (Improper Input Validation), CWE-434 (Unrestricted Upload of File with Dangerous Type), and CWE-74 (URL Manipulation). As no remote code execution or denial\u2011of\u2011service impact is explicitly noted, the primary consequence is incorrect extraction behavior, which may expose files to unintended locations or overwrite existing data.", "risk_and_exploitability": "The CVSS score is 2.0, indicating low severity. The EPSS score is less than 1%, reflecting a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. Likely attack vectors involve an attacker supplying a malicious tar archive to a Python application that unconditionally extracts archives, relying on the incorrect normalization to cause misplacement of extracted files. No additional exploitation chain is described in the data, and the vulnerability does not appear to allow privilege escalation or remote code execution."}}}}, "created": "2026-03-13T09:50:35.583567+00:00", "updated": "2026-03-20T15:48:39.982006+00:00", "vendors": ["python", "python$PRODUCT$cpython"]}