The tarfile module’s extraction filters permit members whose names contain a relative traversal sequence that returns to the intended destination. When such a member is processed, the containment check is performed against the resolved path, but the intermediate directories are created from the unnormalized name, allowing the creation of empty directories outside the extraction target. The file contents themselves are still extracted inside the destination, so only the directory structure is affected. This flaw can be used to place arbitrary empty directories adjacent to a path that a process writes to, potentially facilitating other attacks such as repository poisoning or misleading applications that expect all extraction artifacts to be within the target directory.

This vulnerability is confined to CPython implementations supplied by the Python Software Foundation running on POSIX platforms, including Linux and macOS. Windows is immune because the operating system normalizes '..' components before the filesystem sees the path, preventing the creation of directories outside the destination. Therefore, only systems that execute the tarfile module on a POSIX operating system are affected.

The CVSS score of 6.3 reflects a moderate severity. The EPSS score is less than 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted tar archive and invoke the extraction routine, so remote exploitation requires either a service that performs extraction on untrusted input or a local user with privileges that allow extraction into a sensitive location. While the ability to create empty directories alone is limited, it may combine with other weaknesses to aid in privilege escalation or other attacks.