CyberRota Analysis
AI-GeneratedThe vulnerability arises in the tarfile module when extracting links on systems that do not support them, leading to potential unintended file extraction due to ignored return values in the filter function. This flaw can result in the extraction of unexpected files, which may pose a risk of unauthorized access or data leakage. Organizations using the tarfile module, particularly in environments where file integrity is critical, should prioritize addressing this issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.