Out-of-directory file write via link normalization mismatch

Path traversal in CPython tarfile allows context-dependent attackers to write files outside an extraction directory via a crafted archive. The data_filter containment check uses an unnormalized link target and computes a symlink directory before removing trailing separators, so the normalized link written to disk can redirect later members beyond the destination. Exploitation requires an application or user to extract the malicious archive with the data filter, and writes remain limited to paths permitted for the extracting process.