While working on sqip project, I identified a Hardlink Path Traversal vulnerability in the tar package. The issue occurs in the archive extraction logic, where the package does not properly validate certain drive-relative link paths such as C:../target.txt.
CVE Report
CVE Link