A path traversal vulnerability in pnpm version 9.15.4 and later on Windows allows malicious tarballs to write files outside the intended package directory. This occurs because the path normalization only checks for './' but not for Windows-style backslashes '\\', enabling attackers to escape the package directory and overwrite files such as .npmrc. The issue is specific to Windows due to its use of backslashes as directory separators.