This vulnerability in CPython's tarfile module (CVE-2024-12718) involves improper limitation of pathnames (CWE-22) during extraction of tar archives. When using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar", an attacker can modify file metadata such as last modified timestamps or file permissions (chmod) on files outside the extraction directory. This affects Python versions 3.12 and later, as earlier versions do not support the extraction filter feature. Additionally, from Python 3.14 onward, the default filter value changed to "data", meaning that code relying on default filtering is also affected. The vulnerability does not significantly affect source distribution installations, which inherently allow arbitrary code execution during build processes.

An attacker providing a crafted tar archive can cause modification of file metadata or permissions outside the intended extraction directory when the vulnerable extraction filters are used. This can lead to unauthorized changes to files on the system, potentially impacting system integrity. There is no direct confidentiality or availability impact reported. The vulnerability has a CVSS score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a patch is available, avoid extracting untrusted tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar". For Python 3.14 or later, be aware that the default filter is "data", so explicitly specify a safe filter or avoid extraction of untrusted tar files. Exercise caution when installing source distributions with suspicious links, although this vulnerability does not significantly affect source distribution installations.