Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as ../, causing files to be written outside the intended download directory on the Penelope operator's machine. The impact is limited to files writable by the user running Penelope. …