A flaw was found in BusyBox's tar. The target of a deferred hardlink is resolved through deferred symlinks in its directory components: a symlink entry pointing outside the extraction directory, followed by a hardlink entry whose target passes through that symlink, makes the created hardlink refer to a file outside the extraction directory. A crafted archive can exploit this to pull an arbitrary outside file into the extraction tree as a hardlink; a second archive extracted into the same directory with an overwriting extractor could then replace the outside file's content.