- CVE-2026-4360: TarFile.extract() did not forward the caller's filter to _extract_one(), so on the code path that extracts a hardlink the filter was silently dropped. An archive extracted with filter='data' could therefore create files with an attacker-chosen uid/gid instead of the filtered values (CWE-noinfo: incorrect enforcement of an extraction filter). Backport of cpython 7ccdbaba (gh-151987): extract() now passes filter_function through to _extract_one().