The tmp package version 0.2.3 contains a vulnerability that allows arbitrary temporary file or directory writes outside the intended temporary directory via a symbolic link in the 'dir' parameter. This occurs because the path resolution function does not properly resolve symbolic links, enabling attackers to bypass directory restrictions. The issue is fixed in version 0.2.4.