CVE-2025-4517 incident response for archive-handling services

CVE-2025-4517 is a critical Python tarfile path validation flaw with a CVSS 3.1 rating of 9.4. This arbitrary-file-write vulnerability allows crafted archives to write outside extraction directories, bypassing data or tar filters. To mitigate risks, services should move extraction to low-privilege workers. The Python project released fixes in versions 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4, and 3.14.0b1. Verification must ensure worker containers use patched CPython builds, as host interpreter updates alone are insufficient.