GNU Tar versions through 1.35 are vulnerable to a directory traversal attack that allows file overwrite via a two-step extraction process involving crafted TAR archives. An attacker can first extract an archive containing a symlink pointing to a critical directory, then extract a second archive with a relative path that uses this symlink to overwrite critical files. This bypasses the usual protection against '..' in member names. This vulnerability can impact server applications that automatically extract multiple user-supplied TAR archives and software installation processes that run 'tar xf' multiple times on untrusted tarballs.