Problem with outdated GNUTYPE_NAMES structure parsing allow to create symbolic links outside target directory.
vulners.com/securityvulns/securityvulns:doc:15233