A critical security vulnerability (CVE-2026-114583) in Python's tarfile module allows crafted tar archives with malicious link entries, including symlinks with empty or directory-like names, to bypass tarfile.tar_filter protections. This can cause tarfile.extractall() to write files outside the intended extraction directory, potentially leading to unauthorized file writes. The issue affects Python versions prior to 3.9.9-63.oe2203sp4 and has been fixed in that release. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact if exploited.