The vulnerability in unearth through version 0.18.2 arises from improper limitation of a pathname to a restricted directory due to failure to normalize paths in the is_within_directory function. This allows path traversal attacks where attackers can supply malicious tar archives containing symlink members or traversal sequences (../) that bypass directory containment checks, potentially writing files outside the intended extraction directory. The issue was addressed in commit 6c78164, which corrects the path normalization and validation logic.

Successful exploitation allows an attacker to write files to arbitrary filesystem locations accessible to the unearth process. This can lead to unauthorized file creation or modification, potentially enabling further compromise depending on the privileges of the process running unearth. The CVSS 4.0 score is 7.2 (high severity), indicating a significant risk if exploited.

A fix is available and was introduced in commit 6c78164. Users should upgrade to a version of unearth that includes this commit or later to remediate the vulnerability. No official patch version number is provided, so users should verify the presence of the fix in their version. Until patched, avoid processing untrusted tar archives with unearth.