diff --git a/omnidata_tools/dataset/download.py b/omnidata_tools/dataset/download.py
index d926b93..1738d98 100644
--- a/omnidata_tools/dataset/download.py
+++ b/omnidata_tools/dataset/download.py
@@ -204,7 +204,29 @@ def untar(fpath, model, dest=None, ignore_existing=True,
     src_fpath = os.path.join(tmpdirname, *[getattr(model, a) for a in model.tar_structure])
     if dryrun: print(f'Extracting "{fpath}"" to "{tmpdirname}" and moving "{src_fpath}" to "{dest_fpath}"'); return
     with tarfile.open(fpath) as tar:
-      tar.extractall(path=tmpdirname)
+      
+      import os
+      
+      def is_within_directory(directory, target):
+          
+          abs_directory = os.path.abspath(directory)
+          abs_target = os.path.abspath(target)
+      
+          prefix = os.path.commonprefix([abs_directory, abs_target])
+          
+          return prefix == abs_directory
+      
+      def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+      
+          for member in tar.getmembers():
+              member_path = os.path.join(path, member.name)
+              if not is_within_directory(path, member_path):
+                  raise Exception("Attempted Path Traversal in Tar File")
+      
+          tar.extractall(path, members, numeric_owner=numeric_owner) 
+          
+      
+      safe_extract(tar, path=tmpdirname)
     try:
       shutil.move(src_fpath, dest_fpath)
     except FileNotFoundError as e: