Bug report

On Windows, a member name or link target with a drive but no root, such as C:foo, is not absolute, so the 'tar' and 'data' extraction filters let it through. Their containment check joins it onto the resolved destination, which has the same drive, so it looks contained. Extraction then joins the name onto the destination as given: with extractall("out"), os.path.join("out", "C:foo") is "C:foo", a file in the current directory of drive C:. A symlink to C:foo passes the 'data' filter the same way and is resolved against that directory too. x/../C:foo and ./C:foo become C:foo through the filter's own normalization.

This runs the filters with Windows path handling on any OS:

import ntpath, os, tarfile
os.path = ntpath
os.getcwd = lambda: r'C:\work'
for name in 'C:evil.txt', 'x/../C:evil.txt':
    member = tarfile.data_filter(tarfile.TarInfo(name), 'out')
    print(repr(name), '->', ntpath.abspath(ntpath.join('out', member.name)))
link = tarfile.TarInfo('link')
link.type = tarfile.SYMTYPE
link.linkname = './C:evil.txt'
print('symlink ->', repr(tarfile.data_filter(link, 'out').linkname))

'C:evil.txt' -> C:\work\evil.txt
'x/../C:evil.txt' -> C:\work\evil.txt
symlink -> 'C:evil.txt'

The filters should refuse these with AbsolutePathError and AbsoluteLinkError. gh-154987 is the different-drive case, where the containment check raises ValueError instead.

Reported as a security issue via GHSA by Girish Konda. Assigned CVE-2026-107784.
also later found by anthropic/oss-scanner as ANT-2026-RSL1F4AT

PR ready, reviewed, and approved via GHSA, i'll push that after opening this.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-161323: Refuse drive-relative paths in tarfile extraction filters #161334
• [3.15] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) #161355
• [3.14] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) #161356
• [3.13] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) #161357
• [3.12] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) #161358
• [3.11] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) #161359