Security context

Highlights

Path Traversal: 5 prior fixes. Scrutinize any change in this area.

src/entry.rs: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Path Traversal: PAX header parser desynchronization (CVE-2026-33055) allows malformed size/attribute overrides to target incorrect intermediary extension headers rather than the intended file, facilitating inconsistent unpacking or path traversal.

Path Traversal: TOCTOU race conditions and directory-symlink collisions allow attackers to modify permissions of arbitrary directories outside the target destination, or write through maliciously timed symlinks to arbitrary locations.

Path Traversal: Delayed path validation on long-name entries writes GNU extension headers to the stream before validating the path itself, leaving subsequent stream operations vulnerable to directory traversal.