N\u00eb modulin tarfile t\u00eb p\u00ebrfshir\u00eb n\u00eb shp\u00ebrndarjen standarde t\u00eb Pythonit, i cili ofron funksione p\u00ebr t\u00eb lexuar dhe shkruar arkiva tar, jan\u00eb identifikuar pes\u00eb vulnerabilitete, nj\u00eb prej t\u00eb cilave \u00ebsht\u00eb vler\u00ebsuar si me rrezikshm\u00ebri kritike. Vulnerabilitetet jan\u00eb rregulluar n\u00eb l\u00ebshimet Python 3.13.4 dhe 3.12.11. Vulnerabiliteti m\u00eb i rreziksh\u00ebm (CVE-2025-4517) lejon q\u00eb gjat\u00eb shkarkimit t\u00eb nj\u00eb arkivi t\u00eb dizajnuar posa\u00e7\u00ebrisht t\u00eb shkruhen skedar\u00eb n\u00eb \u00e7do pjes\u00eb t\u00eb sistemit t\u00eb skedar\u00ebve. N\u00eb skenaret sistemor\u00eb q\u00eb p\u00ebrdorin tarfile dhe ekzekutohen me t\u00eb drejta root (p.sh., n\u00eb utilitetet p\u00ebr menaxhimin e paketave dhe kontejner\u00ebve t\u00eb izoluar), ky vulnerabilitet mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rritur privilegjet e veta ose p\u00ebr t\u00eb dal\u00eb jasht\u00eb kontejnerit t\u00eb izoluar. <\/p>\n
Vulnerabiliteti ndikon n\u00eb projekte ku moduli tarfile p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrparuarkivuar arkivat tar t\u00eb paffiduesh\u00ebm, duke p\u00ebrdorur funksionin TarFile.extractall() ose TarFile.extract() me parametrin \"filter=\" t\u00eb vendosur n\u00eb \"data\" ose \"tar\". Vulnerabiliteti shkaktohet nga trajtimi i pap\u00ebrshtatsh\u00ebm t\u00eb sekuenc\u00ebs \"..\" n\u00eb emrin e lidhjes. Problemi ndikon versionet e Python q\u00eb nga 3.12. Re\u017eimi 'filter=\"data\"' aplikohet si parazgjedhje n\u00eb deg\u00ebn Python 3.14, e cila \u00ebsht\u00eb n\u00eb zhvillim (lirimi \u00ebsht\u00eb parashikuar p\u00ebr vjesht\u00ebn). <\/p>\n
Vulnerabilitetet e tjera n\u00eb TarFile: <\/p>\n
\n
CVE-2025-4330 \u2014 nj\u00eb mund\u00ebsi p\u00ebr t\u00eb anashkaluar filtrin e t\u00eb dh\u00ebnave t\u00eb nxjerra, gj\u00eb q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb nxjerrjen nga arkiva t\u00eb nj\u00eb lidhjeje simbolike q\u00eb tregon p\u00ebrtej katalogut baz\u00eb, n\u00eb t\u00eb cilin ekzekutohet shp\u00ebrndarja.\n
CVE-2025-4138 \u2014 nj\u00eb mund\u00ebsi p\u00ebr t\u00eb krijuar lidhje simbolike t\u00eb rast\u00ebsishme p\u00ebrtej katalogut baz\u00eb gjat\u00eb shp\u00ebrndarjes s\u00eb arkivave me parametrin 'filter=\"data\"'.\n
CVE-2024-12718 \u2014 nj\u00eb mund\u00ebsi p\u00ebr t\u00eb ndryshuar metadatat (p.sh., koha e modifikimit) t\u00eb skedar\u00ebve p\u00ebrtej katalogut baz\u00eb gjat\u00eb shp\u00ebrndarjes s\u00eb arkivave me parametrin 'filter=\"data\"' ose t\u00eb drejtave t\u00eb qasjes (chmod) gjat\u00eb shp\u00ebrndarjes s\u00eb arkivave me parametrin 'filter=\"tar\"'.\n
CVE-2025-4435 \u2014 n\u00ebse gjat\u00eb shp\u00ebrndarjes s\u00eb arkivit parametrin TarFile.errorlevel \u00ebsht\u00eb vendosur n\u00eb 0, at\u00ebher\u00eb p\u00ebrkund\u00ebr dokumentacionit, element\u00ebt e arkivave q\u00eb bien n\u00ebn filtrin e caktuar u shp\u00ebrndahen, e jo u injorohen. <\/ul>\n