Arbitrary file write via tar path traversal

Path traversal in Helm 3.0.0 through 3.2.3 allows remote authenticated users to write files outside the plugin directory via a malicious HTTP tar archive. The HTTP plugin extractor joined archive entry names directly to the destination path, so relative or absolute names escaped the intended directory; the patch adds path and symlink checks. Exploitation requires a Helm user to install the attacker-controlled plugin, enabling overwrite of accessible files and potential subsequent code execution.