The tarfile module in CPython versions prior to 3.16.0 on POSIX systems improperly handles directory creation during extraction of tar archives. Specifically, the containment check uses the resolved path to verify extraction safety, but intermediate directories are created from the original member name without resolution. This allows crafted member names containing sequences like '../evil/../dest/sub/file' to cause empty directories to be created outside the intended extraction destination. File contents are still extracted inside the destination directory. Windows platforms are not affected due to path component collapsing before filesystem access.

An attacker can cause the creation of empty directories outside the intended extraction destination on POSIX systems when extracting tar archives using the vulnerable tarfile module. This could potentially be used to influence filesystem structure or confuse security controls, but no file content is extracted outside the destination. Windows systems are not affected. The impact is limited to directory creation and does not include arbitrary file write or code execution.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Users should avoid extracting untrusted tar archives with vulnerable CPython versions on POSIX systems or use alternative extraction methods until a fix is available.