libtar was found to have a flaw where it does not validate the file names stored inside a tar file, which could possibly lead to a file extraction outside the prefix path.

The functions "tar_extract_glob" and "tar_extract_all" accept a path prefix on where to extract files to, but libtar doesn't validate the file names inside the tar file. For example: consider a file name "../../etc/passwd". If extract_all is called with prefix "/home/USER/", libtar would try to overwrite "/etc/passwd".

There is a workaround where a user could validate all filenames inside tar archive before calling tar_extract_*, but it seems that most of the users don't do that, so it's better that libtar should itself validate the file names.

References:
http://seclists.org/oss-sec/2013/q4/69
https://lists.feep.net:8080/pipermail/libtar/2013-October/000362.html