Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-12718: Python tarfile extraction can alter files outside target folder
CVE-2024-12718 · published 1 year ago
Summary
If you use Python 3.12 or newer to unpack untrusted tar files with the tarfile module’s extract functions and set the filter option to "data" or "tar", an attacker could change file timestamps or permissions on files outside the intended extraction folder. This could affect systems running CPython, PyPy3, or Python 3.13 packages on Debian. Switch to a safer filter setting (such as "safety" or "none") or upgrade to a version where the default filter is more restrictive, and avoid extracting untrusted archives without proper validation.
What to do
- Update debian pypy3 to version 7.3.20+dfsg-2.
- Update debian python3.13 to version 3.13.4-1.
- Update python3 to version 3.11.13-r0.
- Update python3 to version 3.12.11-r0.
- Update python3-tkinter to version 3.12.11-r0.
- Update python software foundation cpython to version 3.10.18 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | python software foundation | cpython | < 3.10.18 |
| Debian:12 | debian | pypy3 | All versions |
| Debian:14 | debian | pypy3 |
< 7.3.20+dfsg-2 Fix: upgrade to 7.3.20+dfsg-2
|
| Debian:13 | debian | python3.13 |
< 3.13.4-1 Fix: upgrade to 3.13.4-1
|
| Alpine:v3.19 | – | python3 |
< 3.11.13-r0 Fix: upgrade to 3.11.13-r0
|
| Alpine:v3.20 | – | python3 |
< 3.12.11-r0 Fix: upgrade to 3.12.11-r0
|
| Alpine:v3.23 | – | python3-tkinter |
< 3.12.11-r0 Fix: upgrade to 3.12.11-r0
|
Original advisory text
Bypass extraction filter to modify file metadata outside extraction directory
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
References
- https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f URL
- https://github.com/python/cpython/issues/127987 Third Party Advisory
- https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965... Patch
- https://security.alpinelinux.org/vuln/CVE-2024-12718 Vendor Advisory
- https://mail.python.org/archives/list/[email protected]/thread/MAXIJJ... Vendor Advisory
- https://github.com/python/cpython/issues/135034 Third Party Advisory
- https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd... Patch
- https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390... Patch
- https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2... Patch
- https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2... Patch
- https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b0... Patch
- https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb... Patch
- https://github.com/python/cpython/pull/135037 Patch
- https://security-tracker.debian.org/tracker/CVE-2024-12718 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12718... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-12718 Vendor Advisory
- https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951d... Patch
- https://github.com/python/cpython Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published3 Jun 2025
Updated4 Nov 2026
First seen14 Mar 2026
Sources
CVE-2024-12718 · OSV
CVE-2024-12718 · NVD
CVE-2024-12718 · MITRE
DEBIAN-CVE-2024-12718 · OSV
ALPINE-CVE-2024-12718 · OSV
Track software like this
Free during beta