AIKIDO-2026-574935

TL;DR

TarSafe.extractall() and TarSafe.extract() validate archive members by comparing the resolved member path against the extraction root with a plain string prefix comparison instead of a real path-boundary check. A member whose resolved path merely starts with the same characters as the root, such as a sibling directory, passes the check and is written outside the intended directory. On Windows a pre-filter keyed on the host path separator never runs the containment check for members that use the POSIX-style names required by the tar format, so absolute or drive-relative member names escape as well. Because the library is a drop-in safe replacement used specifically to extract untrusted archives, a crafted archive can write files outside the extraction directory; the fix replaces the prefix comparison with a true path-containment check anchored to the directory actually being extracted into.