This reminds me of a over 10 year old security hole I noticed in tar: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=290435