CVE-2007-4559: Python

Critical severity, CVSS 9.8. EPSS: 27.1% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Affected products

• Python Python: before 3.6.16 (fixed in 3.6.16); from 3.7.0, before 3.8.17 (fixed in 3.8.17); from 3.9.0, before 3.9.17 (fixed in 3.9.17); from 3.10.0, before 3.10.12 (fixed in 3.10.12); from 3.11.0, before 3.11.4 (fixed in 3.11.4)

Published 2007-08-28. Last modified 2026-06-16.