On CPython 3.13.15 for Linux, an attacker-controlled tar archive extracted with the tar or data filter can make tarfile change the permissions and modification time of an existing file outside the extraction directory. The archive also leaves a path inside the extracted tree that resolves to the outside file. Opening that path returns the outside file's content.
This was incidentally fixed by 5a57248 for 3.14+ which changed os.link to use AT_SYMLINK_FOLLOW.
Linked PRs
On CPython 3.13.15 for Linux, an attacker-controlled tar archive extracted with the
tarordatafilter can maketarfilechange the permissions and modification time of an existing file outside the extraction directory. The archive also leaves a path inside the extracted tree that resolves to the outside file. Opening that path returns the outside file's content.This was incidentally fixed by 5a57248 for 3.14+ which changed
os.linkto useAT_SYMLINK_FOLLOW.Linked PRs
tarfilehard links #157191data/tarfilter bypass via hard link to a symlink #157192