The vulnerability involves a failure to correctly sanitize file paths when extracting tar archives in vlt. This path traversal flaw, identified as CWE-23, permits a malicious archive to create or overwrite files outside the intended extraction directory. If an attacker can influence the contents of a tar file processed by vlt, they could place files in sensitive locations or even overwrite system configuration, potentially leading to privilege escalation or denial of service.

The issue affects all releases of the vlt package before version 1.0.0‑rc.10. Vendors and users should verify that they are running v1.0.0‑rc.10 or later. All earlier releases, including release candidates up to rc.9, are vulnerable.

The CVSS base score of 5.9 categorizes the flaw as moderate, and the EPSS score indicates a low likelihood of exploitation (<1%). It is not listed in the CISA KEV catalog. The simplest exploitation path is delivering a crafted tar file to a system running vlt and invoking the extraction routine. Because the flaw does not require network exposure and depends on local execution of vlt, an attacker must either have local access or be able to trick a user or automated process into opening a malicious archive.