The 'go tool pack' subcommand, typically used internally by the Go compiler, does not sanitize output filenames. This vulnerability allows extracting a crafted archive file to write files to arbitrary locations on the filesystem, potentially leading to unauthorized file modification or overwriting.