Security fix for CVE-2026-11940: Fix symlink escape via tarfile
hardlink-extraction fallback. The patch adds a filter check on the
hardlink target name before extraction to prevent symlink escapes.
The test decorator was adapted from upstream's @symlink_test to
@support.skip_unless_symlink for Python 3.9 compatibility.
CVE: CVE-2026-11940
Upstream patches:
- 27dd970bf6.patch
Resolves: RHEL-227223
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
