The vulnerability CVE-2026-7774 affects the Python Software Foundation's CPython implementation, specifically the tarfile module's data_filter function. Crafted tar archive entries, including symbolic links with empty or directory-like names, can bypass the data_filter protections. This bypass enables tarfile.extractall() to write files outside the extraction directory, violating intended directory boundaries and potentially allowing unauthorized file writes. The issue is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability was published on 2026-06-04 with a CVSS 4.0 score of 6.9 (medium severity). No patch or official remediation level has been documented, and no exploits are currently known.

Successful exploitation allows an attacker to craft a malicious tar archive that, when extracted using tarfile.extractall(), can write files outside the intended extraction directory. This can lead to overwriting or creating files arbitrarily on the filesystem with the permissions of the extracting process, potentially compromising system integrity or security. The impact is limited to the permissions of the user performing the extraction and does not require privileges or user interaction beyond extraction.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should avoid extracting untrusted tar archives using tarfile.extractall() or implement manual checks to validate archive contents before extraction.