func UnpackXzTar(filename string, destination string, verbosityLevel int) (err error) {
	Verbose = verbosityLevel
	if !common.FileExists(filename) {
		return fmt.Errorf("file %s not found", filename)
	}
	if !common.DirExists(destination) {
		return fmt.Errorf("directory %s not found", destination)
	}
	filename, err = common.AbsolutePath(filename)
	if err != nil {
		return err
	}
	err = os.Chdir(destination)
	if err != nil {
		return errors.Wrapf(err, "error changing directory to %s", destination)
	}
	// #nosec G304
	f, err := os.Open(filename)
	if err != nil {
		return err
	}
	defer f.Close()
	// Create an xz Reader
	r, err := xz.NewReader(f, 0)
	if err != nil {
		return err
	}
	// Create a tar Reader
	tr := tar.NewReader(r)
	return unpackTarFiles(tr)
}
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.