01 Record

CVE-2025-4138

Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

HighPUBLISHEDCNA: PSF

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View raw JSON

02 Description

Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

1.38% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 71.9% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Deferred. NVD last modified this record on 2026-07-31.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-06-03 12:59Z1 YR AGO

Last updated

2026-07-31 14:03Z3 MO AGO

Reserved

2025-04-30

Assigning CNA

PSF

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

Data version

5.2

Document digest

4f9e8940515c5dd13e98f0dea1d2bff1abdf5b6f91c146b31f2c46af273d973f

05 Affected products

VendorProductVersionsPlatforms

Python Software FoundationCPython0 to < 3.9.23, 3.10.0 to < 3.10.18, 3.11.0 to < 3.11.13, 3.12.0 to < 3.12.11, 3.13.0 to < 3.13.4, 3.14.0a1 to < 3.14.0b3—

06 References

github.comhttps://github.com/python/cpython/issues/135034issue-tracking
github.comhttps://github.com/python/cpython/pull/135037patch
mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/vendor-advisory
github.comhttps://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390apatch
github.comhttps://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2apatch
gist.github.comhttps://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42fmitigation
github.comhttps://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951dapatch
github.comhttps://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01patch
github.comhttps://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9patch
github.comhttps://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2epatch
github.comhttps://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965apatch
github.comhttps://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1patch

07 Fixed in

AlmaLinux 8

platform-python
Fixed in 3.6.8-70.el8_10.alma.1
platform-python-debug
Fixed in 3.6.8-70.el8_10.alma.1
platform-python-devel
Fixed in 3.6.8-70.el8_10.alma.1
python3-idle
Fixed in 3.6.8-70.el8_10.alma.1
python3-libs
Fixed in 3.6.8-70.el8_10.alma.1
python3-test
Fixed in 3.6.8-70.el8_10.alma.1
python3-tkinter
Fixed in 3.6.8-70.el8_10.alma.1
python3.11
Fixed in 3.11.13-1.el8_10
python3.11-debug
Fixed in 3.11.13-1.el8_10
python3.11-devel
Fixed in 3.11.13-1.el8_10
python3.11-idle
Fixed in 3.11.13-1.el8_10
python3.11-libs
Fixed in 3.11.13-1.el8_10
python3.11-rpm-macros
Fixed in 3.11.13-1.el8_10
python3.11-test
Fixed in 3.11.13-1.el8_10
python3.11-tkinter
Fixed in 3.11.13-1.el8_10
python3.12
Fixed in 3.12.11-1.el8_10
python3.12-debug
Fixed in 3.12.11-1.el8_10
python3.12-devel
Fixed in 3.12.11-1.el8_10
python3.12-idle
Fixed in 3.12.11-1.el8_10
python3.12-libs
Fixed in 3.12.11-1.el8_10
python3.12-rpm-macros
Fixed in 3.12.11-1.el8_10
python3.12-test
Fixed in 3.12.11-1.el8_10
python3.12-tkinter
Fixed in 3.12.11-1.el8_10
python39
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-Cython
Fixed

A version is affected if any line below covers it.
- Affected before 0.29.21-5.module_el8.6.0+2780+a40f65e1
- Affected before 0.29.21-5.module_el8.6.0+3248+c431e88c
python39-PyMySQL
Fixed in 0.10.1-2.module_el8.6.0+2780+a40f65e1
python39-attrs
Fixed in 20.3.0-2.module_el8.6.0+2780+a40f65e1
python39-cffi
Fixed

A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.6.0+2780+a40f65e1
- Affected before 1.14.3-2.module_el8.6.0+3248+c431e88c
python39-chardet
Fixed in 3.0.4-19.module_el8.6.0+2780+a40f65e1
python39-cryptography
Fixed in 3.3.1-3.module_el8.10.0+3765+2f9a457d
python39-debug
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-devel
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idle
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idna
Fixed in 2.10-4.module_el8.10.0+3849+a48d89aa
python39-iniconfig
Fixed in 1.1.1-2.module_el8.6.0+2780+a40f65e1
python39-libs
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-lxml
Fixed

A version is affected if any line below covers it.
- Affected before 4.6.5-1.module_el8.6.0+2780+a40f65e1
- Affected before 4.6.5-1.module_el8.6.0+3248+c431e88c
python39-mod_wsgi
Fixed in 4.7.1-7.module_el8.10.0+3989+a618fe15.1
python39-more-itertools
Fixed in 8.5.0-2.module_el8.6.0+2780+a40f65e1
python39-numpy
Fixed

A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c

32 further packages in AlmaLinux 8 not shown (first 40 listed).

AlmaLinux 9

python-unversioned-command
Fixed in 3.9.21-2.el9_6.1
python3
Fixed in 3.9.21-2.el9_6.1
python3-debug
Fixed in 3.9.21-2.el9_6.1
python3-devel
Fixed in 3.9.21-2.el9_6.1
python3-idle
Fixed in 3.9.21-2.el9_6.1
python3-libs
Fixed in 3.9.21-2.el9_6.1
python3-test
Fixed in 3.9.21-2.el9_6.1
python3-tkinter
Fixed in 3.9.21-2.el9_6.1
python3.11
Fixed in 3.11.11-2.el9_6.1
python3.11-debug
Fixed in 3.11.11-2.el9_6.1
python3.11-devel
Fixed in 3.11.11-2.el9_6.1
python3.11-idle
Fixed in 3.11.11-2.el9_6.1
python3.11-libs
Fixed in 3.11.11-2.el9_6.1
python3.11-test
Fixed in 3.11.11-2.el9_6.1
python3.11-tkinter
Fixed in 3.11.11-2.el9_6.1
python3.12
Fixed in 3.12.9-1.el9_6.1
python3.12-debug
Fixed in 3.12.9-1.el9_6.1
python3.12-devel
Fixed in 3.12.9-1.el9_6.1
python3.12-idle
Fixed in 3.12.9-1.el9_6.1
python3.12-libs
Fixed in 3.12.9-1.el9_6.1
python3.12-test
Fixed in 3.12.9-1.el9_6.1
python3.12-tkinter
Fixed in 3.12.9-1.el9_6.1

AlmaLinux 10

python-unversioned-command
Fixed in 3.12.9-2.el10_0.2

CloudLinux 8

platform-python
Fixed in 3.6.8-70.el8_10.alma.1
platform-python-debug
Fixed in 3.6.8-70.el8_10.alma.1
platform-python-devel
Fixed in 3.6.8-70.el8_10.alma.1
python3-idle
Fixed in 3.6.8-70.el8_10.alma.1
python3-libs
Fixed in 3.6.8-70.el8_10.alma.1
python3-test
Fixed in 3.6.8-70.el8_10.alma.1
python3-tkinter
Fixed in 3.6.8-70.el8_10.alma.1
python3.11
Fixed in 3.11.13-1.el8_10
python3.11-debug
Fixed in 3.11.13-1.el8_10
python3.11-devel
Fixed in 3.11.13-1.el8_10
python3.11-idle
Fixed in 3.11.13-1.el8_10
python3.11-libs
Fixed in 3.11.13-1.el8_10
python3.11-rpm-macros
Fixed in 3.11.13-1.el8_10
python3.11-test
Fixed in 3.11.13-1.el8_10
python3.11-tkinter
Fixed in 3.11.13-1.el8_10
python3.12
Fixed in 3.12.11-1.el8_10
python3.12-debug
Fixed in 3.12.11-1.el8_10
python3.12-devel
Fixed in 3.12.11-1.el8_10
python3.12-idle
Fixed in 3.12.11-1.el8_10
python3.12-libs
Fixed in 3.12.11-1.el8_10
python3.12-rpm-macros
Fixed in 3.12.11-1.el8_10
python3.12-test
Fixed in 3.12.11-1.el8_10
python3.12-tkinter
Fixed in 3.12.11-1.el8_10
python39
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-Cython
Fixed

A version is affected if any line below covers it.
- Affected before 0.29.21-5.module_el8.6.0+2780+a40f65e1
- Affected before 0.29.21-5.module_el8.6.0+3248+c431e88c
python39-PyMySQL
Fixed in 0.10.1-2.module_el8.6.0+2780+a40f65e1
python39-attrs
Fixed in 20.3.0-2.module_el8.6.0+2780+a40f65e1
python39-cffi
Fixed

A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.6.0+2780+a40f65e1
- Affected before 1.14.3-2.module_el8.6.0+3248+c431e88c
python39-chardet
Fixed in 3.0.4-19.module_el8.6.0+2780+a40f65e1
python39-cryptography
Fixed in 3.3.1-3.module_el8.10.0+3765+2f9a457d
python39-debug
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-devel
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idle
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idna
Fixed in 2.10-4.module_el8.10.0+3849+a48d89aa
python39-iniconfig
Fixed in 1.1.1-2.module_el8.6.0+2780+a40f65e1
python39-libs
Fixed in 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-lxml
Fixed

A version is affected if any line below covers it.
- Affected before 4.6.5-1.module_el8.6.0+2780+a40f65e1
- Affected before 4.6.5-1.module_el8.6.0+3248+c431e88c
python39-mod_wsgi
Fixed in 4.7.1-7.module_el8.10.0+3989+a618fe15.1
python39-more-itertools
Fixed in 8.5.0-2.module_el8.6.0+2780+a40f65e1
python39-numpy
Fixed

A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c

32 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

python-unversioned-command
Fixed in 3.9.21-2.el9_6.1
python3
Fixed in 3.9.21-2.el9_6.1
python3-debug
Fixed in 3.9.21-2.el9_6.1
python3-devel
Fixed in 3.9.21-2.el9_6.1
python3-idle
Fixed in 3.9.21-2.el9_6.1
python3-libs
Fixed in 3.9.21-2.el9_6.1
python3-test
Fixed in 3.9.21-2.el9_6.1
python3-tkinter
Fixed in 3.9.21-2.el9_6.1
python3.11
Fixed in 3.11.11-2.el9_6.1
python3.11-debug
Fixed in 3.11.11-2.el9_6.1
python3.11-devel
Fixed in 3.11.11-2.el9_6.1
python3.11-idle
Fixed in 3.11.11-2.el9_6.1
python3.11-libs
Fixed in 3.11.11-2.el9_6.1
python3.11-test
Fixed in 3.11.11-2.el9_6.1
python3.11-tkinter
Fixed in 3.11.11-2.el9_6.1
python3.12
Fixed in 3.12.9-1.el9_6.1
python3.12-debug
Fixed in 3.12.9-1.el9_6.1
python3.12-devel
Fixed in 3.12.9-1.el9_6.1
python3.12-idle
Fixed in 3.12.9-1.el9_6.1
python3.12-libs
Fixed in 3.12.9-1.el9_6.1
python3.12-test
Fixed in 3.12.9-1.el9_6.1
python3.12-tkinter
Fixed in 3.12.9-1.el9_6.1

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

CloudLinux 10

python-unversioned-command
Fixed in 3.12.9-2.el10_0.2

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Debian 12

pypy3
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

pypy3
No fix yet
python3.13
Fixed in 3.13.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

pypy3
Fixed in 7.3.20+dfsg-2
python3.13
Fixed in 3.13.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

python3.12
Fixed in 3.12.3-1ubuntu0.7

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

python3.14
Fixed in 3.14.0-1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.