Poetry, a Python dependency manager, had a path traversal vulnerability (CWE-22) in its extractall() function located in src/poetry/utils/helpers.py lines 410-426. This vulnerability affects versions prior to 2.3.4 when running on supported Python versions 3.10.0 through 3.10.12 and 3.11.0 through 3.11.4, due to lack of path traversal protection when tarfile.data_filter is unavailable. The flaw allows extraction of tarballs without restricting pathnames to a safe directory, potentially enabling files to be written outside intended locations. The issue is resolved in poetry version 2.3.4. Red Hat advisories acknowledge this vulnerability and provide updates for affected products.

The vulnerability allows an attacker to perform path traversal during extraction of sdist tarballs, potentially leading to files being written outside the intended directory. The CVSS 4.0 base score is 0.6 (low severity), indicating limited impact. There is no indication of known exploits in the wild. The impact is limited to affected poetry versions running on specific Python versions lacking tarfile.data_filter support.

A fix is available in poetry version 2.3.4. Users should upgrade to version 2.3.4 or later to remediate this vulnerability. Red Hat provides advisories and updates addressing this issue for their affected products. Patch status is confirmed by vendor advisories. No additional mitigation steps are specified or required beyond applying the official fix.