diff --git a/libmat2/archive.py b/libmat2/archive.py
index f90385bd475441985845c3c2a7dc16f6f922d284..39fb23e8a86a31daa8a20d8bb97f6d6835df347e 100644
--- a/libmat2/archive.py
+++ b/libmat2/archive.py
@@ -190,8 +190,14 @@ class ArchiveBasedAbstractParser(abstract.AbstractParser):
                 if member_name[-1] == '/':  # `is_dir` is added in Python3.6
                     continue  # don't keep empty folders
 
-                zin.extract(member=item, path=temp_folder)
                 full_path = os.path.join(temp_folder, member_name)
+                if not os.path.abspath(full_path).startswith(temp_folder):
+                    logging.error("%s contains a file (%s) pointing outside (%s) of its root.",
+                            self.filename, member_name, full_path)
+                    abort = True
+                    break
+
+                zin.extract(member=item, path=temp_folder)
 
                 try:
                     original_permissions = os.stat(full_path).st_mode