The tarfile module in CPython versions prior to 3.16.0 contains a directory traversal vulnerability on POSIX systems. When extracting tar archives, the containment check uses the resolved path to prevent directory traversal, but intermediate directories are created from the original member name without normalization. This allows empty directories to be created outside the intended extraction destination if the member name includes sequences like ../evil/../dest/sub/file. The actual file contents remain inside the destination directory. On Windows, path normalization prevents this issue. This vulnerability does not affect extraction into secure randomized directories that do not share the final component of the destination path.

An attacker can cause the creation of empty directories outside the intended extraction directory on POSIX systems when extracting crafted tar archives. This may lead to confusion or potential misuse of filesystem structure but does not allow extraction of file contents outside the destination. There is no indication of direct code execution or data compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid extracting untrusted tar archives on POSIX systems using vulnerable CPython versions or use extraction into secure randomized directories that do not share the final component of the destination path.