Changes in R-devel Bug Fixes:
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the umask to extracted files; also no longer restores setuid or setgid permission bits. Similarly,...
https://developer.r-project.org/blosxom.cgi/R-devel/NEWS/2026/10/23