jaraco.context, a Python package providing decorators and context managers, contains a Zip Slip path traversal flaw in its tarball() function from version 5.2.0 up to, but not including, 6.1.0. The flaw allows the strip_first_component filter to resolve paths containing ../ sequences incorrectly, so files can be extracted outside the intended extraction directory. When a malicious tar archive or nested tarball is processed, paths such as dummy_dir/../../etc/passwd become ../../etc/passwd, exposing files such as /etc/passwd or configuration files that the application should not access.

The vulnerability affects all releases of the jaraco.context package from 5.2.0 through 6.0.x. The package is available on PyPI and is used in a range of Python projects. Version 6.1.0 and later include the patch that guards against the traversal issue. Users who depend on jaraco.context in their application logic or build scripts are at risk when they process untrusted tar archives with the bundled tarball() helper.

The CVSS score of 8.6 classifies this flaw as High severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers could supply a crafted archive to a service or run a local script that calls tarball() to extract arbitrary files from the host file system, thereby compromising confidentiality, integrity, or availability of the filesystem structure.