Changes in R-devel Bug Fixes:
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the ‘umask’ to extracted files; also no longer restores ‘setuid’ or ‘setgid’ permission bits. Simi...
https://developer.r-project.org/blosxom.cgi/R-devel/NEWS/2026/10/24