Special characters in file name, skipped during extraction, allow to masquarade directory traversal.
vulners.com/securityvulns/securityvulns:doc:4506