diff --git a/frontend/mate/mate/build/build.py b/frontend/mate/mate/build/build.py
index c4f7fe0..03058e5 100644
--- a/frontend/mate/mate/build/build.py
+++ b/frontend/mate/mate/build/build.py
@@ -670,7 +670,26 @@ def _attach_source_lines_to_nodes(self, session: orm.Session) -> None:
                 # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it?
                 local_artifact = source_artifact.persist_locally(suffix=".tar.gz")
                 with tarfile.open(local_artifact, "r:gz") as tar:
-                    tar.extractall(path=temp_source_dir.name)
+                    def is_within_directory(directory, target):
+                        
+                        abs_directory = os.path.abspath(directory)
+                        abs_target = os.path.abspath(target)
+                    
+                        prefix = os.path.commonprefix([abs_directory, abs_target])
+                        
+                        return prefix == abs_directory
+                    
+                    def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+                    
+                        for member in tar.getmembers():
+                            member_path = os.path.join(path, member.name)
+                            if not is_within_directory(path, member_path):
+                                raise Exception("Attempted Path Traversal in Tar File")
+                    
+                        tar.extractall(path, members, numeric_owner=numeric_owner) 
+                        
+                    
+                    safe_extract(tar, path=temp_source_dir.name)
                 source_dir = Path(temp_source_dir.name)
             elif source_artifact.kind == ArtifactKind.CompileTargetBrokeredChallenge:
                 local_artifact = source_artifact.persist_locally(suffix=".zip")
diff --git a/frontend/mate/mate/build/compile.py b/frontend/mate/mate/build/compile.py
index ca0ebab..9e2b7b3 100644
--- a/frontend/mate/mate/build/compile.py
+++ b/frontend/mate/mate/build/compile.py
@@ -710,7 +710,26 @@ def _compile_tarball_local(self, artifact: db.Artifact) -> None:
         try:
             # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it?
             with tarfile.open(local_target, "r:gz") as tar:
-                tar.extractall(path=local_target_dir.name)
+                def is_within_directory(directory, target):
+                    
+                    abs_directory = os.path.abspath(directory)
+                    abs_target = os.path.abspath(target)
+                
+                    prefix = os.path.commonprefix([abs_directory, abs_target])
+                    
+                    return prefix == abs_directory
+                
+                def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+                
+                    for member in tar.getmembers():
+                        member_path = os.path.join(path, member.name)
+                        if not is_within_directory(path, member_path):
+                            raise Exception("Attempted Path Traversal in Tar File")
+                
+                    tar.extractall(path, members, numeric_owner=numeric_owner) 
+                    
+                
+                safe_extract(tar, path=local_target_dir.name)
         except tarfile.TarError as e:
             self._raise(
                 f"failed to open/extract tarball: {e}",
@@ -785,7 +804,26 @@ def _compile_tarball_containerized(self, artifact: db.Artifact) -> None:
         local_target = artifact.persist_locally(suffix=".tar.gz")
         try:
             with tarfile.open(local_target, "r:gz") as tar:
-                tar.extractall(path=scratch_src)
+                def is_within_directory(directory, target):
+                    
+                    abs_directory = os.path.abspath(directory)
+                    abs_target = os.path.abspath(target)
+                
+                    prefix = os.path.commonprefix([abs_directory, abs_target])
+                    
+                    return prefix == abs_directory
+                
+                def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+                
+                    for member in tar.getmembers():
+                        member_path = os.path.join(path, member.name)
+                        if not is_within_directory(path, member_path):
+                            raise Exception("Attempted Path Traversal in Tar File")
+                
+                    tar.extractall(path, members, numeric_owner=numeric_owner) 
+                    
+                
+                safe_extract(tar, path=scratch_src)
         except tarfile.TarError as e:
             self._raise(
                 "failed to open/extract tarball",