A directory traversal flaw in HPE NonStop Python 3.x permits an attacker to replace arbitrary files when a TAR archive contains filenames with a ".." sequence. The vulnerability can overwrite critical system files, potentially leading to denial of service, privilege escalation, or code execution if system binaries are replaced. This weakness stems from insufficient validation of archive paths during extraction.

The affected product is Hewlett Packard Enterprise's HPE NonStop Python 3.x. No specific version ranges are supplied, so all versions in the 3.x line are potentially vulnerable unless a patch is applied.

The CVSS score of 8 indicates a high severity flaw, but the EPSS score of less than 1% and the lack of listing in CISA's KEV catalog suggest a low probability of active exploitation. The likely attack vector is remote or local delivery of a malicious TAR file to the application; this inference is based on the nature of the vulnerability and typical use of TAR archives in NonStop systems.