GHSA-mw29-5qxh-rr87

tarfile.tar_filter can be bypassed with crafted link entries. This may cause tarfile.extractall() to write files outside the intended extraction directory.