## The problem
Issue jenkinsci/jenkins#26563 (closed, 13 comments): Stashed symlink makes unstash impossible. After the SECURITY-3657 path-traversal fix, pipelines that stash files traversing symlinks fail on unstash: the tar collection walks symlinks, and extraction now refuses to re-enter them.
## What fixed it
If unstash suddenly fails after a Jenkins upgrade and your stashes cross symlinks, the SECURITY-3657 path-traversal fix is blocking the tar extraction from re-entering symlinked paths. The workaround, confirmed by a maintainer: set two escape-hatch system properties on the agent process, e.g. java -Dhudson.FilePath.ALLOW_REENTRY_PATH_TRAVERSAL=true -Dhudson.FilePath.ALLOW_UNTAR_SYMLINK_RESOLUTION=true -jar agent.jar ... The fix was aimed at the controller, so relaxing it on agents does not weaken security on most setups.