func UnpackTar(filename string, destination string, verbosityLevel int) (err error) {
	Verbose = verbosityLevel
	f, err := os.Stat(destination)
	if os.IsNotExist(err) {
		return fmt.Errorf("destination directory '%s' does not exist", destination)
	}
	filemode := f.Mode()
	if !filemode.IsDir() {
		return fmt.Errorf("destination '%s' is not a directory", destination)
	}
	if !validSuffix(filename) {
		return fmt.Errorf("unrecognized archive suffix")
	}
	var file *os.File
	// #nosec G304
	if file, err = os.Open(filename); err != nil {
		return err
	}
	defer file.Close()
	err = os.Chdir(destination)
	if err != nil {
		return errors.Wrapf(err, "error changing directory to %s", destination)
	}
	var fileReader io.Reader = file
	var decompressor *gzip.Reader
	if strings.HasSuffix(filename, globals.GzExt) {
		if decompressor, err = gzip.NewReader(file); err != nil {
			return err
		}
		defer decompressor.Close()
	}
	var reader *tar.Reader
	if decompressor != nil {
		reader = tar.NewReader(decompressor)
	} else {
		reader = tar.NewReader(fileReader)
	}
	return unpackTarFiles(reader)
}
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.