A directory traversal vulnerability exists in tar-fs versions 1.16.4 and below, 2.1.2 and below, and 3.0.8 and below, allowing extraction of files outside the specified directory when processing crafted tarballs. This issue has been patched in versions 1.16.5, 2.1.3, and 3.0.9. A workaround involves using the ignore option to skip non-file and non-directory entries such as symlinks.