The vulnerability arises from a logic flaw in Python’s tarfile module that resolves extraction paths without properly sanitizing them, allowing attackers to craft archive entries that resolve to paths outside the intended extraction directory. When an archive is extracted with the filter parameter set to 'data' or 'tar' – which is also the default from Python 3.14 onward – the library expands paths using an insecure realpath algorithm. As a result, an adversary can extract files to any location within the process’s writable filesystem, enabling arbitrary overwrite or creation of files. This represents a CWE‑22 path traversal flaw and can be leveraged for modifications or persistence.

The flaw is present in CPython, the standard Python interpreter, for versions that allow the use of tarfile with the filter parameter set to 'data' or 'tar'. Since Python 3.14 changed the default filter to 'data', this vulnerability affects all installations running Python 3.14 or later when the default extraction behavior is used. Earlier Python versions are affected only when applications explicitly pass filter='data' or filter='tar'. The vulnerability does not depend on any particular operating‑system runtime and is therefore relevant to any platform that runs CPython, including Red Hat Enterprise Linux families and other distributions.

The CVSS score of 9.4 indicates a severe impact if exploited. The EPSS score is below 1 %, suggesting a low present exploitation probability, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker supplying a malicious tar archive to a Python process that calls TarFile.extractall or TarFile.extract with a safe filter. In practice this could occur when a software component or user processes untrusted archives, for instance during package installation or data import. A locally running Python process, especially one with elevated privileges, could modify or create arbitrary files, potentially leading to privilege escalation or persistence.