CVE-2026-46561: Incomplete Tarfile Symlink Validationcve-2026-46561-incomplete-tarfile-symlink-validation
Validation of tarfile extraction was observed to lack checks for symbolic links. Calling `.extractall()` after iterating through `.getmembers()` without verifying `.issym()` or `.islnk()` may allow symlink escape attacks (CWE-61). Attackers can bypass directory boundaries by deploying malicious symlinks inside the archive, routing subsequent extractions outs
