The vulnerability arises because the _make_special_file() function in Archive::Tar passes the tar header's linkname directly to the symlink() system call without validating whether the target path is absolute or contains directory traversal sequences (e.g., '..'). This improper link resolution (CWE-59) allows an attacker to craft a tar archive with symlinks pointing outside the extraction directory. When the archive is extracted, these symlinks can cause subsequent file operations to access attacker-chosen paths, potentially leading to unauthorized file access or modification. The secure-extract mode that guards regular file extraction does not apply to symlink targets, leaving this attack vector open.

Successful exploitation can lead to unauthorized reading or writing of files outside the intended extraction directory, which may compromise system integrity or confidentiality depending on the context in which Archive::Tar is used. There are no known exploits in the wild at this time. The impact depends on how the extracted files are subsequently accessed and the privileges of the process performing extraction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid extracting untrusted tar archives with vulnerable versions of Archive::Tar or implement manual validation of symlink targets before extraction. Consider running extraction in a restricted environment or with least privilege to limit potential impact.