This vulnerability is a file type validation weakness involving improper handling of archive concatenation (CWE-434 and CWE-1287). When pip receives a concatenated tar and ZIP archive, it treats it solely as a ZIP file, ignoring the file name or dual‑format content. Consequently, pip may install unintended files based on the mistaken archive type. Based on the description, it is inferred that an attacker would need to provide a malicious archive file to pip during installation in order to influence the outcome. The resulting issue does not provide direct code execution but can lead to incorrect or misleading package contents being installed by the user.

The Python Packaging Authority’s pip tool is affected. No specific version information is provided, so any unpatched pip releases prior to the safe‑concatenation fix may be vulnerable.

The CVSS score of 4.6 indicates a moderate impact. The EPSS score of < 1% suggests an extremely low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to supply a malicious archive file to pip during an installation, which could result in unintended package contents but does not directly enable arbitrary code execution. The risk remains moderate and should be mitigated by updating pip to a version that correctly handles concatenated archives.