An archive extraction boundary is the intended limit of where files from an archive may be written when the archive is unpacked. It is a safety rule that prevents entries from escaping the target directory and overwriting other files on the system.
This matters because archive parsers often process filenames supplied by untrusted users, build systems, or package feeds. If extraction logic fails to enforce the boundary, a crafted archive can use path tricks to place files in unexpected locations, leading to file corruption, configuration changes, code execution, or data exposure. Defenders reduce this risk by normalizing paths, rejecting absolute or parent-traversal paths, resolving symlinks carefully, and extracting into controlled directories with strict validation. In secure software, the boundary is not just a convenience; it is a trust barrier.