Unearth (<= 0.18.2)

The unearth library version 0.18.2 and earlier contains a path traversal vulnerability in the is_within_directory function that permits arbitrary file writes via malicious archives.