Python tarfile: data/tar filter bypass via hard link to symlink

Vulnerability Summary: tarfile data/tar Filter Bypass (Hard Link to Symlink) Vulnerability Overview Title: tarfile data/tar filter bypass via hard link to a symlink (#157190) Status: Open Reporter: StanFrondeind (created 1 week ago) Description: In CPython 3.13.15 for Linux, an attacker-controlled tar archive can cause to modify the permissions and modification times (mtime) of existing files outside the extraction directory when unpacking with the or filter; the archive also leaves a path outside the extraction directory. Opening this path retains the directory of the external file. Labels: , , , , Related PRs: - gh-157190: Follow symlinks when extracting hard links (#157191) - 3.13 gh-157190: Fix / filter bypass via hard link to a symlink (GH-157191) #157192 - 3.14 gh-157190: Follow symlinks when extracting hard links (GH-157191) #157281 - 3.15 gh-157190: Follow symlinks when extracting hard links (GH-157191) #157282 - 3.12 gh-157190: Fix / filter bypass via hard link to a symlink (GH-157191) #157504 Impact Scope Affected Versions: CPython 3.13.15 (Linux) Impact: An attacker can craft a malicious tar archive to modify the permissions and mtime of files outside the extraction directory during unpacking, and leave a path in an external directory, resulting in a data/filter bypass. Severity: Critical Fix Fix PR: gh-157190: Follow symlinks when extracting hard links (#157191) Fix Description: Follow symlinks when extracting hard links, thereby fixing the / filter bypass via hard link to a symlink. Commit History: - added 2 comments referencing this issue - added a commit referencing this issue (pythonh-157190: Follow symlinks when extracting hard links) - added a commit referencing this issue (pythonh-157190: Follow symlinks when extracting hard links) POC / Exploit Code The page does not include a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

Python tarfile: data/tar filter bypass via hard link to symlink

More from this source