It was discovered that missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. https://security-tracker.debian.org/tracker/DSA-6559-1