In astral-tokio-tar versions 0.6.0 and earlier, the unpack_in API could change permissions of directories outside the intended archive by following symlinks. This vulnerability allows a crafted tar archive to modify external directory permissions but does not affect individual file permissions. The issue is fixed in version 0.6.1, which changes the method used to avoid symlink traversal.