Applications treat names, paths, and extensions carried inside archive manifests and download metadata as if the application had chosen them. It did not. A tar entry pathname, an HLS subtitle URI, a shortcut extension. Each is attacker-controlled. Each is later used verbatim as a filesystem decision. We study three 2026 CVEs that share this structure. CVE-2026-63134 (CISA Malcolm, CVSS 5.4) is a directory traversal in which directory entries skip the path guard that file entries pass. os.path.join(dest, "/tmp/x") evaluates to /tmp/x because Python discards every argument before an absolute component. The destination silently vanishes. CVE-2026-63133 (CVSS 6.5) is an inode-exhaustion denial of service in the same extractor. A ~50 KB archive of 50,000 empty directory entries creates 50,000 inodes in 2.2 s at an amplification of 1.0 inode per compressed byte. A depth-axis variant produces many inodes from one entry. CVE-2026-50023 (yt-dlp, CVSS 8.3) is executable-shortcut injection. A permission scoped to the --write-link feature was hoisted to a global extension allowlist. A subtitle track whose URI ends in .desktop writes an executable shortcut under --write-subs. The unifying class is trusting attacker-controlled filesystem metadata. The cross-cutting root cause is a guard/sink mismatch. The security predicate is applied to one representation or context and omitted at a semantically equivalent sink. We give the exact code, payloads, and measured numbers, and ship three static audit rules.