Comment by thirdplace_

i think more bugs reside here.

if tarball or path is user input then they could be used to inject tar command options.