GNU Tar through version 1.35 allows an attacker to overwrite files by exploiting directory traversal in a crafted TAR archive extraction process involving two steps. The first archive creates a symlink pointing to a critical directory using a relative path containing '..'. The second archive contains a file path starting with the symlink name and ending with a critical file name. When extracted sequentially into the same directory, the second extraction follows the symlink and overwrites the critical file, bypassing protections that block '..' in a single archive. This affects scenarios where multiple TAR archives are extracted into the same directory, such as automated server or package installation workflows.

The vulnerability allows an attacker to overwrite critical files on the victim system by leveraging a two-step TAR extraction process involving directory traversal via symlinks. This can lead to integrity violations and potential denial of service if critical files are overwritten. The attack requires user interaction to extract two separate archives sequentially and cannot be performed by a single archive due to existing protections. There is no indication of confidentiality or availability impact beyond file overwrite.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting multiple TAR archives sequentially into the same directory if the archives are untrusted. Review extraction workflows to prevent symlink-based directory traversal attacks. Consider extracting archives into isolated directories and verifying archive contents before extraction.