The vulnerability in Python's CPython tarfile module (CVE-2026-7774) involves a bypass of the data_filter function through specially crafted link entries, including symbolic links with empty or directory-like names. This bypass enables an attacker to redirect extraction of archive members outside the target directory when using tarfile.extractall(). The flaw is a directory traversal issue categorized under CWE-22. It affects multiple CPython versions including 3.11.0, 3.12.0, 3.13.0, 3.14.0, and 3.15.0a1. The CVSS 4.0 base score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges required, but requiring user interaction and resulting in high impact on integrity.

Successful exploitation allows an attacker to write files outside the intended extraction directory, potentially overwriting or creating arbitrary files on the target system with the permissions of the user running the extraction. This can lead to unauthorized file modification or code execution depending on the context and permissions. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted tar archives with tarfile.extractall() or use safer extraction methods that validate paths. Monitor official Python channels for updates and patches.