CVE-2007-4559

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 27.10%
EPSS Percentile: 98.05%
CISA KEV: Not listed

Description

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 28-Aug-2007 08:17
Last Modified: 17-Jun-2026 05:44
EPSS Date: 2026-10-23
CWE: CWE-22

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

python / python
Version / affected range: * · before (exclusive) 3.6.16
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python / python
Version / affected range: * · from (inclusive) 3.7.0 · before (exclusive) 3.8.17
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python / python
Version / affected range: * · from (inclusive) 3.9.0 · before (exclusive) 3.9.17
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python / python
Version / affected range: * · from (inclusive) 3.10.0 · before (exclusive) 3.10.12
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python / python
Version / affected range: * · from (inclusive) 3.11.0 · before (exclusive) 3.11.4
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

References

Last enrichment sync: 24-Oct-2026 21:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Observations added by the new indicators: VULNERABILITY listed CVE-2007-4559 Python tarfile with EPSS around 0.9 on two of the three involved instances. AWS Adds Five Risk Indicators to GuardDuty Extended Threat Detection

CVE (6)

MITRE ATT&CK (1)

Vendors (1)

Products (8)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.