Path Traversal

dbt-common is vulnerable to Path traversal. The vulnerability is due to the use of os.path.commonprefix for validating extraction paths, where commonprefix compares paths character‑by‑character rather than by path components, and an attacker can exploit this by providing a malicious tarball that...