Arbitrary file overwrite via link following

Path traversal in moby/go-archive before 0.3.0 allows attackers to overwrite writable files via a crafted tar archive. Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer keep entries under the destination with lexical path checks, but the later filesystem operation lets the OS resolve archive-created links, so writes can escape the extraction root. In Docker products, reachability typically requires a local copy-out such as docker cp or sbx cp against attacker-controlled container content; the result is arbitrary file creation or overwrite as the extracting user, which can become host code execution if a sensitive executable or configuration file is replaced.