The vulnerability stems from the handling of symbolic links during extraction. The commit cde4605 added a critical check in _extractList() to compare realpath(dirname(symlink_target)) against realpath(extraction_path). Prior to this fix (versions <=1.4.11), there was no validation to prevent symlinks from resolving outside the target directory. The patch directly modifies this function, confirming it as the vulnerable point. The CVE description explicitly references inadequate symlink checking during write operations, which aligns with this function's responsibility for processing archive entries.