CVE-2025-8869: pip's fallback tar extraction doesn't check symbolic links point to extraction directory

The vulnerability is a path traversal issue in pip's fallback tar extraction mechanism, which is used on Python versions that do not implement PEP 706 (e.g., Python < 3.9.17, < 3.10.12, < 3.11.4). The root cause is the failure to validate symbolic links within tar archives before extraction.

The analysis of the patch f2b92314da012b9fffa36b3f3e67748a37ef464a reveals that the function _untar_without_filter in src/pip/_internal/utils/unpacking.py was responsible for this insecure behavior. Before the fix, it would extract any symbolic link, allowing an attacker to craft a tar file with a symlink pointing to a sensitive location outside the intended extraction directory (e.g., ../../.ssh/authorized_keys). When a user on a vulnerable system installed this malicious package, pip would create this link, potentially leading to arbitrary file creation or overwrite.

The function untar_file acts as the dispatcher. It checks for the presence of the secure tarfile.data_filter and, if absent, calls the vulnerable _untar_without_filter function. Therefore, both untar_file and _untar_without_filter would appear in a runtime profile during exploitation. The patch remediates this by adding a new function, is_symlink_target_in_tar, and using it within _untar_without_filter to ensure that all symbolic link targets are safely contained within the archive before extraction.