Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2007-4559

46
FAUCET Score

CVE-2007-4559 is a critical directory traversal vulnerability affecting the tarfile module in Python, allowing attackers to overwrite arbitrary files by crafting TAR archives with ".." sequences in filenames. With a CVSS score of 9.8 (CRITICAL), this flaw is easily exploitable over a network without user interaction, leading to complete compromise of confidentiality, integrity, and availability. Although no public exploit code is listed, it has garnered significant community attention and media coverage, indicating its potential for exploitation and the widespread impact across numerous projects. Despite its age, recent discussions highlight its continued relevance and the challenges in fully patching older Python runtimes.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.6.16CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.7.0, < 3.8.17CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.9.0, < 3.9.17CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.10.0, < 3.10.12CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.11.0, < 3.11.4CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

6.8MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
6.4
CvssVersion
2.0

Exploit Intelligence

EPSS Score
27.10%
Probability of exploitation in next 30 days
EPSS Percentile
97.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.2710 is in the 95th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (34)

denopatch availablevia llm_extracted
View patch
keraspatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: cbl2 python3 3.9.19-1 on CBL Mariner 2.0Fixed in: 3.9.19-1
microsoftpatch availablevia msrc
Product: cbl2 python2 2.7.18-8 on CBL Mariner 2.0Fixed in: 2.7.18-8
microsoftpatch availablevia msrc
Product: 18458-16820Fixed in: 3.7.16-1
microsoftpatch availablevia msrc
Product: 16906-16820Fixed in: 2.7.18-5
microsoftpatch availablevia msrc
Product: 17386-16823Fixed in: 3.9.19-1
microsoftpatch availablevia msrc
Product: 16905-16823Fixed in: 2.7.18-8
microsoftpatch availablevia msrc
Product: cm1 python3 3.7.16-1 on CBL Mariner 1.0Fixed in: 3.7.16-1
microsoftpatch availablevia msrc
Product: cm1 python2 2.7.18-5 on CBL Mariner 1.0Fixed in: 2.7.18-5
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 3.9.19-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 3.9.19-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 2.7.18-5
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 2.7.18-5
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 2.7.18-8
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 2.7.18-8
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python-pip-0:9.0.3-22.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python3-0:3.6.8-47.el8_6.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: python-pip-0:9.0.3-22.1.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.11-pip-0:22.3.1-4.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.11-0:3.11.5-1.el9_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.9-0:3.9.18-1.el9_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python-pip-0:21.2.3-7.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-0:3.8.18-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-pip-0:19.3.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python-pip-0:9.0.3-23.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3.11-0:3.11.5-1.el8_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3.11-pip-0:22.3.1-4.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39:3.9-8090020230922213827.7484f1d1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39-devel:3.9-8090020230922213827.7484f1d1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38:3.8-8090020230810143931.d9f72c26
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38-devel:3.8-8090020230810143931.d9f72c26
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3-0:3.6.8-56.el8_9
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python27:2.7/python2

Vendor Advisories (8)

microsoft2024-Dec/CVE-2007-4559

CVE-2007-4559

Dec 10, 2024
microsoft2024-Nov/CVE-2007-4559

CVE-2007-4559

Nov 12, 2024
microsoft2024-Oct/CVE-2007-4559

CVE-2007-4559

Oct 8, 2024
kerasllm-keras-d13bbd8768a57997CRITICAL

HP ThinPro 8.1 SP 2 Security Updates

Apr 12, 2024
denollm-deno-650ac71876afb4f8CRITICAL

HP ThinPro 8.1 SP 2 Security Updates

Apr 12, 2024
microsoft2020-Sep/CVE-2007-4559

CVE-2007-4559

Sep 8, 2020
redhatCVE-2007-4559Moderate

python: tarfile module directory traversal

Aug 24, 2007
microsoft2007-Aug/CVE-2007-4559Moderate

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive a related issue to CVE-2001-1267.

Aug 2, 2007

References

lists.fedoraproject.org / archives/list/[email protected]/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6
lists.fedoraproject.org / archives/list/[email protected]/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH
lists.fedoraproject.org / archives/list/[email protected]/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A
mail.python.org / pipermail/python-dev/2007-August/074290.html
Mailing ListVendor Advisory
mail.python.org / pipermail/python-dev/2007-August/074292.html
ExploitMailing List
bugzilla.redhat.com / show_bug.cgi
Issue Tracking
secunia.com / advisories/26623
Broken Link
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A
security.gentoo.org / glsa/202309-06
vupen.com / english/advisories/2007/3022
Broken Link