Can you contact the security team (info at https://www.python.org/dev/security/ ) directly?

In general, tarfile (and other Python file functions!) can create files anywhere on the filesystem, provided that the process user has the right permissions.  But it seems that you’re talking about an unexpected behaviour leading to unwanted operations, so please send more details about the problem to the team.  Thank you for your report!