CyberRota Analysis
AI-GeneratedThe tarfile module in CPython 3.13 and earlier is vulnerable to crafted tar archives that can exploit hard links to symbolic links, potentially leading to unauthorized modifications of file permissions or timestamps outside the intended extraction directory. This vulnerability could also expose sensitive file contents within the extracted directory structure. Organizations using affected versions of CPython should prioritize patching to mitigate the risk of data exposure and integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.