UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
{ "urgency": "not yet assigned" }