The vulnerability allows the tarfile extraction filter to be ignored. An attacker can create a tar archive that contains symbolic links pointing outside the intended extraction directory. When the archive is extracted with TarFile.extractall() or extract() and the filter parameter is set to "data" or "tar", the library will follow those links and write files at the target locations, modifying or creating arbitrary files and metadata. This constitutes a CWE-22, allowing local systems to perform arbitrary file writes and potentially gain elevated privileges.

The issue exists in the CPython implementation distributed by the Python Software Foundation. It affects systems running CPython versions before the applied patches, including those bundled with Red Hat Enterprise Linux 8 and 9, RHEL AUS, RHEL E4S, RHEL EUS, RHEL TUS, and RHEL 10 derivatives as enumerated by the provided CPE strings.

The CVSS score of 7.5 indicates a high impact potential when the flaw is exercised. The EPSS score of 1% modestly indicates that exploitation is not yet widespread but remains feasible. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale publicly executed exploits are known. An attacker requires local code execution to supply a crafted tar archive; once executed, the attacker can overwrite files outside the designated extraction directory, leading to data corruption or privilege escalation if privileged processes extract the archive.