The vulnerability in CPython's tarfile.extractall() function involves an attacker crafting a tar archive where a hardlink points to a symlink located deeper in the archive. During extraction, the fallback validation checks the symlink at its archived location but recreates it at the hardlink's shallower path. This allows a relative symlink target to escape the destination directory filter, enabling out-of-directory file reads or writes. This vulnerability is classified under CWE-22 (Path Traversal) and CWE-59 (Link Following) and represents an incomplete fix of CVE-2025-4330.

An attacker can craft a malicious tar archive that, when extracted using tarfile.extractall(), can create symlinks pointing outside the intended extraction directory. This can lead to unauthorized file reads or writes outside the destination directory, potentially compromising system integrity or confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid extracting untrusted tar archives using tarfile.extractall() or apply manual validation of archive contents to prevent directory traversal via symlinks and hardlinks.