Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too)
CVSS: 9.3 (CRITICAL)
Component: data_extract_all.c in tar extraction - hardlink and symlink
handling

Description:
Hardlink entries in tar archives are created without validation of the
link_target path. This allows modification of files outside the extraction
directory and bypasses existing path traversal mitigations. This
vulnerability has higher impact than the path traversal issue as it does
not rely on relative paths or the current working directory.

Technical Details:
- Hardlink entries can point to absolute paths like /etc/passwd
- Symlink entries suffer from the same root cause (missing link_target
validation)
- When extraction is performed with elevated privileges, attackers can
modify critical system files

Impact:
Arbitrary file modification outside extraction directory, privilege
escalation when combined with elevated extraction permissions, bypass of
path traversal protections.

Note: While hardlinks and symlinks share the same root cause (missing
link_target validation), I'm requesting a single CVE for this issue.