- CVE-2026-87910: keep the result of the first filter_function() call in tarfile's makelink_with_filter() and return early when it is None, so a filter that skips a member by returning None is honoured when link extraction falls back to copying the target under the link's own, shallower name, instead of the member being extracted anyway. Carries upstream's test_extract_filters_target_none. The doubled filter call this fixes is the CVE-2026-11940 guard, which is native in 3.12.14 and is not carried by a patch of ours - CVE-2026-19672: collapse ".." components with os.path.normpath() in tarfile's _get_filtered_attrs() before the containment check, so a member whose name leaves the destination and comes back, such as "../evil/../dest/sub/file", no longer creates the intermediate directories outside the destination under the "tar" and "data" filters. The containment check looked at the resolved path, which stayed inside, while the directories were created from the name as given. Backport of upstream commit 97688346, carrying its test_parent_dir_out_and_back. Member names containing ".." are now normalized with os.path.normpath(), which removes internal ".." components and may change the meaning of a name that traverses symbolic links