What happened
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Affected versions
CPython: before 3.10.22 (python); 3.11.0 through before 3.11.17 (python); 3.12.0 through before 3.12.15 (python); 3.13.0 through before 3.13.16 (python); 3.15.0a1 through before 3.15.0rc3 (python) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.