The vulnerability stems from Drupal's use of a vulnerable PEAR Archive_Tar library version. The Tar archiver component (Drupal\Component\Archiver\Tar) directly interacts with this library. Its extract() method calls Archive_Tar::extract(), which had directory traversal and symlink vulnerabilities. When Drupal processes user-uploaded archives through this component (common in core/modules/file or update manager), it enables attackers to write arbitrary files - including PHP payloads - to the filesystem. The connection between Archive_Tar vulnerabilities and Drupal's file processing architecture makes Tar::extract() the primary vulnerable entry point.