@cR0w haha, yep!
Quoting from the type.cyhsu.xyz link,
“Somehow, the sanity of the file paths within the SysContainerDomain was not checked, allowing the inclusion of the infamously unsafe string ../ […]. Because SysContainerDomain files are unpacked under
/var/.backup.i/var/mobile/Library/Backup/System Containers/Data/
during restoration, the path
SysContainerDomain-../../../../../../../..
resolves to / [. This] allows access to system files.”
Shortened b/c text limit