The vulnerability in CPython's tarfile module involves the errorlevel attribute set to 0, which is intended to skip extraction of filtered members. However, in affected versions, filtered members are still extracted contrary to documentation. This is classified under CWE-682 (Incorrect Calculation) and has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation link is provided in the data, and no known exploits are reported.

The vulnerability can lead to unintended extraction of archive members that should have been skipped, potentially allowing malicious or unwanted files to be extracted. This impacts the integrity of the extraction process but does not affect confidentiality or availability. Since the attack vector is network-based and requires no privileges or user interaction, remote exploitation is feasible if an attacker can supply crafted tar archives to a vulnerable system.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should exercise caution when extracting tar archives with filters using affected CPython versions. Avoid processing untrusted tar files or implement additional validation to ensure only intended members are extracted.