diff --git a/luminoth/tools/checkpoint/__init__.py b/luminoth/tools/checkpoint/__init__.py
index 1f0aec31..db492c3b 100644
--- a/luminoth/tools/checkpoint/__init__.py
+++ b/luminoth/tools/checkpoint/__init__.py
@@ -319,7 +319,26 @@ def download_remote_checkpoint(db, checkpoint):
     click.echo("Importing checkpoint... ", nl=False)
     with tarfile.open(path) as f:
         members = [m for m in f.getmembers() if m.name != 'metadata.json']
-        f.extractall(output, members)
+        def is_within_directory(directory, target):
+            
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+        
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            
+            return prefix == abs_directory
+        
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+        
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+        
+            tar.extractall(path, members, numeric_owner=numeric_owner) 
+            
+        
+        safe_extract(f, output, members)
     click.echo("done.")
 
     # Update the checkpoint status and persist database.
@@ -674,7 +693,26 @@ def import_(path):
     # directory.
     with tarfile.open(path) as f:
         members = [m for m in f.getmembers() if m.name != 'metadata.json']
-        f.extractall(output_path, members)
+        def is_within_directory(directory, target):
+            
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+        
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            
+            return prefix == abs_directory
+        
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+        
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+        
+            tar.extractall(path, members, numeric_owner=numeric_owner) 
+            
+        
+        safe_extract(f, output_path, members)
 
     # Store metadata into the checkpoint index.
     db['checkpoints'].append(metadata)