The vulnerability in python-poetry affects the extractall() function in src/poetry/utils/helpers.py, which extracts sdist tarballs without adequate path traversal protection on specific supported Python versions lacking tarfile.data_filter. This improper limitation of pathnames (CWE-22) could allow files to be extracted outside the target directory. The issue is resolved in poetry 2.3.4.

An attacker could craft a malicious source distribution tarball that, when extracted by vulnerable poetry versions on affected Python versions, may write files outside the intended extraction directory. This could lead to overwriting arbitrary files if the user has sufficient permissions. However, the CVSS score is low (0.6), indicating limited impact and exploitability. No known exploits have been reported.

Upgrade poetry to version 2.3.4 or later, where this path traversal vulnerability is fixed. Since no official remediation level is provided beyond this, applying the update is the recommended action. Patch status is confirmed by the vendor's versioning information.