The vulnerability in Python's CPython tarfile.extractall() arises when extracting tar archives with the 'data' or 'tar' filter. A malicious archive can include a hardlink that references a symlink located at a deeper path than the hardlink itself. During extraction, the fallback validation checks the symlink at its archived location but recreates it at the shallower hardlink path. This discrepancy allows a relative symlink target to escape the destination directory, potentially permitting out-of-directory file system access. This flaw represents an incomplete remediation of CVE-2025-4330.

Exploitation of this vulnerability can allow an attacker to create symlinks during archive extraction that point outside the intended destination directory. This can lead to unauthorized file reads or writes outside the extraction path, potentially compromising system integrity or confidentiality. The CVSS 4.0 score of 7.8 (high severity) reflects the network attack vector with no privileges or user interaction required, and high scope impact.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted tar archives using tarfile.extractall() with the 'data' or 'tar' filter, or apply manual validation of archive contents to prevent directory traversal via symlinks and hardlinks.