One more possible bug (I don't know if this is reachable) is that the tarfile.extractall method is used in the static method _untarzip_image. This method is also vulnerable to path traversal (as per the warning in the tarfile module documentation).
One more possible bug (I don't know if this is reachable) is that the tarfile.extractall method is used in the
static method _untarzip_image. This method is also vulnerable to path traversal (as per the warning in the tarfile module documentation).