CVE-2026-23949 is a Zip Slip path traversal vulnerability in the jaraco.context package used by icloudpd and setuptools. The flaw exists in the strip_first_component filter function used during tar archive extraction, which improperly handles path components and allows extraction of files outside the intended directory. This can lead to arbitrary file writes to locations such as /tmp or home directories. The vulnerability affects icloudpd versions from 1.17.7 up to but not including 1.33.0. A fix is available in version 1.33.0.