I'd say that the issue is only a vulnerability if you're doing tar -C / (which would be dumb). The actual issue appears to be that the filtering features of GNU

I'd say that the issue is only a vulnerability if you're doing tar -C / (which would be dumb). The actual issue appears to be that the filtering features of GNU tar are applied before pathname sanitisation (which is the actual security bug). The title (and some of the wording in the disclosure) lead me to believe that GNU tar would let you extract to paths outside the -C directory (which would be very bad). So I kinda see the PoV of the maintainer, though I don't agree with the filter ordering.