On Windows, a maliciously crafted tarball can write files outside of the extraction directory.

Impact

Path traversal (CWE-22). A crafted tar archive can cause files to be created or overwritten outside the extraction directory.

Applications and scripts running on Windows Ruby (platforms where File::ALT_SEPARATOR is "\", such as mswin and mingw) that extract tar archives from sources they don't fully control, using Minitar.unpack, Minitar::Input#extract_entry, or Minitar::Input#each. Platforms where File::ALT_SEPARATOR is nil, including Linux, macOS, and the BSDs, are not affected, because \ is not a separator there and is extracted as a literal filename character.

A crafted archive can cause files to be created or overwritten outside the destination directory, limited to locations the extracting process can write to. Exploitation requires a user or process to extract the attacker-supplied archive. Further impact depends on what is writable and what the overwritten files are used for.