dbt-common's safe_extract function, used to unpack tarball archives, validates file extraction paths using os.path.commonprefix(). This function compares paths at the character level rather than component level, allowing a crafted tarball to place extracted files outside the intended directory but within a sibling directory sharing a common name prefix. The flaw permits an attacker to write arbitrary files to unauthorized locations, potentially overwriting configuration or executable files and enabling privilege escalation or other system tampering. The weakness is identified as CWE‑22, a directory traversal vulnerability.

The vulnerability affects dbt-labs' dbt-common library. Versions prior to 1.34.2 for the 1.x.x series and prior to 1.37.3 for the 1.3.x series are impacted. All affected builds that invoke safe_extract during tarball extraction are at risk, including those used by dbt‑core and adapter implementations that rely on the shared utilities.

The CVSS score of 2 indicates low severity, and the EPSS probability of less than 1 % suggests limited exploitation likelihood. Because the flaw requires the attacker to supply a malicious tarball and the vulnerable extraction routine to be invoked, the attack vector is local or remote via supply chain depending on how the tarball is provided. The vulnerability is not listed in CISA’s KEV catalog. While the risk level is currently low, organizations deploying dbt-common should update promptly to mitigate the possibility of file system compromise.