Arbitrary writes via tarfile realpath overflow
CVSS score
9.4
EPSS probability
%1.4
Risk score
0.1
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Privilege Escalation script for CVE-2025-4517
A high-performance Python toolkit to automate the CVE-2025-4517 PATH_MAX bypass exploit. Specifically tuned for the WingData HTB challenge to achieve arbitrary file writes and root persistence
Path traversal vulnerability in Python's tarfile.
Exploit for CVE-2024-6232 - Python Tarfile Realpath Overflow
PoC and explanation for CVE-2025-4517 used in a CTF I was playing.
Python tarfile data filter bypass via PATH_MAX overflow in os.path.realpath() - CVE-2025-4517 / CVE-2025-4330
CVE-2025-4517 (CVSS 9.4 – Critical) A vulnerability in Python's `tarfile`
CVE‑2025‑4517 Proof‑of‑Concept Script
Similar Vulnerabilities
Extraction filter bypass for linking outside extraction directory
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
tarfile opened in streaming mode mishandles EOF
tarfile extraction filter bypass allows escaping the destination directory
Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-4517"