Outside-directory creation via exit-and-reentry paths

Path traversal in CPython tarfile before 3.16.0 allows attackers to create empty directories outside the extraction destination via crafted archive member names. The tar and data extraction filters validate the resolved final path for a member, but create intermediate directories from the original name, so a name that leaves the destination and later returns to it can still create outside directories first. Exploitation requires a POSIX target and a member name that includes the destination directory's final component; only empty directories are created outside the destination, while extracted file contents remain inside it.