[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0

[ChuckWoodraska]

Bug report

Bug description:

From the docs https://docs.python.org/3.11/library/tarfile.html#tarfile.data_filter it sounds like setting errorlevel to 0 and having a filter should logged that the offending member was skipped and continue extraction. It looks like it actually logs the filter error and extracts the offending member. The below code shows the filtererror and the extraction.

From the docs: When a filter refuses to extract a file, it will raise an appropriate exception, a subclass of FilterError. This will abort the extraction if TarFile.errorlevel is 1 or more. With errorlevel=0 the error will be logged and the member will be skipped, but extraction will continue.

I was expecting it to tell me the file it skipped and not have any extraction with the given code.

import tarfile

with open('test.txt', 'w') as f:
    f.write('Hello')

with tarfile.open('my_archive.tar', 'w:xz') as tar:
    tar.add('test.txt', arcname='../test.txt')

with tarfile.open("my_archive.tar") as tar:
    tar.debug = True
    tar.errorlevel = 0
    print(tar.errorlevel)

    tar.extractall(filter="data")

CPython versions tested on:

3.11

Operating systems tested on:

macOS

Linked PRs

• gh-112887: Fix tarfile FilterError handling to skip member extraction #112954

[encukou]

This became CVE-2025-4435.
Thank you for reporting it!

Fixed in #135037 and backported to all maintained branches.