CVE-2026-7774 describes a directory traversal vulnerability in the Python Software Foundation's CPython implementation. The tarfile.data_filter function can be bypassed by specially crafted tar archives containing link entries such as symlinks with empty or directory-like names. This bypass allows tarfile.extractall() to write files outside the target extraction directory, potentially overwriting arbitrary files if the extracting process has sufficient permissions. The vulnerability affects CPython versions 3.14.0 and 3.15.0a1. No official patch or remediation level is provided in the available data, and no known exploits are reported in the wild.

An attacker can craft a malicious tar archive that, when extracted using tarfile.extractall(), writes files outside the intended extraction directory. This can lead to unauthorized file creation or overwriting, potentially compromising system integrity or security depending on the permissions of the extracting process. The vulnerability does not require privileges or user interaction but does require the victim to extract the malicious archive.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted tar archives using tarfile.extractall(). Consider using safer extraction methods that validate paths or restrict extraction to intended directories.