ARC 5.21q allows directory traversal via a full pathname in an archive file.

Source