CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...