Log in Start free

Vulnerability · Published Mar 12, 2026 · Assigned by PSF

CVE-2025-13462tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Low 2.0

In plain English

A low-severity unrestricted file upload in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.0Low
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python3.113.11.2-6+deb12u8DEBIAN-CVE-2025-13462
Debian:13python3.133.13.5-2+deb13u1DEBIAN-CVE-2025-13462
Debian:14python3.143.14.3-4DEBIAN-CVE-2025-13462
Ubuntu:22.04:LTSpython3.103.10.12-1~22.04.16USN-8509-1
Ubuntu:22.04:LTSpython3.103.10.12-1~22.04.16UBUNTU-CVE-2025-13462
Ubuntu:24.04:LTSpython3.123.12.3-1ubuntu0.15USN-8509-1
Ubuntu:24.04:LTSpython3.123.12.3-1ubuntu0.15UBUNTU-CVE-2025-13462
Ubuntu:25.10python3.13no fix listedUBUNTU-CVE-2025-13462
Ubuntu:25.10python3.14no fix listedUBUNTU-CVE-2025-13462
Ubuntu:26.04:LTSpython3.143.14.4-1ubuntu0.1USN-8509-1

Affected products (as reported)

VendorProductVersions
Python Software Foundation CPython 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.133.14.0 – before 3.14.43.15.0a1 – before 3.15.0a8

Weakness: CWE-434, CWE-74, CWE-20 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References