--- /n/sources/plan9/sys/src/cmd/tar.c	Thu Nov 28 10:50:00 2013
+++ /sys/src/cmd/tar.c	Tue Sep 22 00:00:00 2026
@@ -1067,6 +1067,11 @@
 
 	fd = -1;
 	cleanname(fname);
+	/* cleanname leaves a leading .. alone, and that escapes the directory */
+	if (strcmp(fname, "..") == 0 || strncmp(fname, "../", 3) == 0) {
+		fprint(2, "%s: refusing to extract %s\n", argv0, fname);
+		return -1;
+	}
 	switch (hp->linkflag) {
 	case LF_LINK:
 	case LF_SYMLINK1:
--- /n/sources/plan9/sys/man/1/tar	Tue Jul 27 11:00:07 2010
+++ /sys/man/1/tar	Tue Sep 22 00:00:00 2026
@@ -48,6 +48,9 @@
 If no file argument is given, extract the entire archive.
 If the archive contains multiple entries for a file,
 the latest one wins.
+A name that leads out of the current directory through
+.B ..
+is not extracted.
 .PP
 The modifiers are:
 .TP