Path traversal when extracting symbolic links

An archive entry that first creates a symlink and then writes through it escapes the extraction root, allowing an attacker-authored archive to write outside the target directory.

SyntheticThis advisory is invented for the demonstration. tar is a real package; nothing described here has been reported against it.