The vulnerability in OCaml-tar before version 3.4.0 arises from improper handling of path traversal sequences ('../') in archive filenames. This flaw permits an attacker to craft a tar archive that, when decompressed by ocaml-tar, writes files outside the designated extraction directory, potentially overwriting arbitrary files on the filesystem. The standard tar(1) utility prevents this behavior, but ocaml-tar does not, leading to a directory traversal and arbitrary file write vulnerability. No patch or remediation information is currently available.

An attacker who can supply a malicious tar archive to an ocaml-tar decompression endpoint can write files to arbitrary locations outside the intended extraction directory. This could lead to overwriting critical files, potentially resulting in code execution, privilege escalation, or denial of service depending on the context of use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid decompressing untrusted tar archives with vulnerable versions of ocaml-tar. Implement additional validation or sandboxing around decompression operations to prevent exploitation.