This vulnerability in CPython's tarfile module (CVE-2024-12718) involves improper limitation of pathname to a restricted directory (CWE-22). When extracting tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar", attackers can modify file metadata such as last modified timestamps or file permissions outside the extraction directory. This affects Python versions 3.12 and later, with the default filter changing to "data" in Python 3.14, potentially increasing the risk if default extraction behavior is used. Earlier versions do not include the extraction filter feature and are not affected. The vulnerability does not notably affect source distribution installations due to their inherent risk profile.

The vulnerability allows an attacker who can supply a crafted tar archive to modify file metadata or permissions outside the intended extraction directory during extraction. This could lead to unauthorized changes to file attributes, potentially aiding further attacks or evasion. There is no direct impact on confidentiality or availability, and no known exploits have been reported. Source distribution installations are not significantly affected due to existing risks during build processes.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar". For Python 3.14 or later, be aware that the default filter is "data", so explicitly specify a safer filter or avoid extraction of untrusted archives. Exercise caution when installing source distributions with suspicious links. Monitor official Python advisories for updates and patches.