diff --git a/mcs/python/shinra.py b/mcs/python/shinra.py
index 3076b13..f664012 100644
--- a/mcs/python/shinra.py
+++ b/mcs/python/shinra.py
@@ -698,7 +698,26 @@ def prepareUserFiles(self, userid, gameid):
 			gameDir = os.path.dirname(self.cloudDir)
 			logger.debug("Untar %s to %s", self.archivePath, gameDir)
 			with tarfile.open(self.archivePath, 'r:gz') as t:
-				t.extractall(gameDir)
+	def is_within_directory(directory, target):
+		
+		abs_directory = os.path.abspath(directory)
+		abs_target = os.path.abspath(target)
+	
+		prefix = os.path.commonprefix([abs_directory, abs_target])
+		
+		return prefix == abs_directory
+	
+	def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+	
+		for member in tar.getmembers():
+			member_path = os.path.join(path, member.name)
+			if not is_within_directory(path, member_path):
+				raise Exception("Attempted Path Traversal in Tar File")
+	
+		tar.extractall(path, members, numeric_owner=numeric_owner) 
+		
+	
+	safe_extract(t, gameDir)
 	
 	# clean both the directories which are not in the hashes file, and the directories which contain nothing
 	def cleanUnusedDirectories(self):