The vulnerability in CPython's Tarfile.extract() function (CVE-2026-4360) involves improper handling of the filter parameter when extracting hardlinks from tar archives. Specifically, the filter parameter intended to restrict extraction is not passed properly for hardlinks, potentially allowing files to be created with unexpected uid/gid values. This could occur when extracting content from untrusted tar files. The issue is tracked under CWE-281 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Affected versions include all CPython versions before 3.16.0, including 3.15.0a1 and 3.14.0. The CVSS 4.0 base score is 2.0, indicating low severity. No official fix or patch has been documented yet.

An attacker who can supply a crafted tar file to an affected system may cause files to be extracted with unexpected user and group IDs, potentially leading to unauthorized file ownership or access. However, the impact is limited by the low CVSS score and the requirement for user interaction and privileges (high privileges needed to exploit). There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid extracting tar files from untrusted sources or apply additional manual checks on extracted file ownership. Monitor Python Software Foundation advisories for updates.