CVE-2025-13462CWE-20CWE-434CWE-74unrestricted-file-upload

CVE-2025-13462

Low · published March 12, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-03-12T22:16Z
Affected products (9)
ProductVersionsFixed in
python/python< 3.13.133.13.13
python/python≥ 3.14.0, < 3.14.43.14.4
python/pythonall versions—
python/pythonall versions—
python/pythonall versions—
python/pythonall versions—
python/pythonall versions—
python/pythonall versions—
python/pythonall versions—
References (9)
https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab · [email protected]https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 · [email protected]https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 · [email protected]https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 · [email protected]https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 · [email protected]https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 · [email protected]https://github.com/python/cpython/issues/141707 · [email protected]https://github.com/python/cpython/pull/143934 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/ · [email protected]
EPSS history
Timeline
  • 12 MAR 17:59Z
    tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
    cvelistv5