The tar-fs package contains a vulnerability (CVE-2024-12905) involving improper link resolution and path traversal during extraction of crafted tar files. This flaw allows an attacker to write or overwrite files outside the intended extraction directory, potentially leading to unauthorized file modifications. The issue affects multiple versions of tar-fs prior to fixed releases 1.16.4, 2.1.2, and 3.0.7.