A path traversal vulnerability in libarchive's unpackToDir function allows an attacker to write arbitrary files outside the intended extraction directory. This occurs because entry names starting with '..' are not validated and are passed to libarchive without secure extraction flags. This can lead to arbitrary file writes with the extracting process's privileges, potentially enabling code execution if malicious files are planted. The issue is fixed in libarchive version 3.0.6.0.