#extraction

CPython tarfile filters allow escape via hard link to symlink

CVE-2026-82049 lets crafted archives alter or disclose files outside the extraction directory on CPython 3.13 and earlier.