Exploit for CVE-2025-4517

githubexploit · 2026-02-17

Description

Exploit and explanation for CVE-2025-4517 used in a capture the flag challenge.

Entry point

Parameterbackup_path · path

Path/opt/backup_clients/restore_backup_clients.py

TarFile.extractall() with filter="data" can bypass safeguards and write files outside the extraction directory.

All known vulnerabilities by product

Almalinux Astra Linux Centos Debian Ibm Aix Linuxmint Python Red Hat

CVSS 9.4 for CVE-2025-4517

9.4

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:LOW

Working code

48%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

1.4%higher than 70.0% of all CVEs

Updated 2026-08-25

CVE Information

Exploit Details

Modified:2026-02-17 01:38

Last Seen:2026-02-17 01:43

Reporter:kerburenthusiasm

Written in:Python

Last commit:2026-02-17

Tags

exploitationproof of conceptcapture the flagvulnerability 2025 4517exploit explanation

Other exploits for CVE-2025-4517

CVE-2025-4517-POC

2026-09-07 KitPloitKITPLOIT

CVE-2025-4517-PoC

2026-09-05 KitPloitKITPLOIT

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

2026-09-03 KitPloitKITPLOIT

CVE-2025-4517-poc

2026-09-03 KitPloitKITPLOIT

CVE-2025-4517-PoC

2026-09-02 KitPloitKITPLOIT

PyPath-Escape-CVE-2025-4517-Exploit-Research

2026-09-02 KitPloitKITPLOIT

CVE-2025-4517-POC-Sudoers

2026-09-02 KitPloitKITPLOIT

CVE-2025-4517-tarfile-PATH_MAX-bypass

2026-08-31 KitPloitKITPLOIT

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=845EFB22-E221-5A3E-83FC-7B501255798A
# CVE-2025-4517-PoC
PoC and explanation for CVE-2025-4517 used in a CTF I was playing.