NetSight
IP …
high7.5Known exploited

CVE-2020-36193

Directory Traversal in Archive_Tar

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-08-25. Federal due date: 2022-09-15.

Apply updates per vendor instructions.

Impact

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. ### :exclamation: Note: There was an [initial fix](https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916) for this vulnerability made in version `1.4.12`. That fix introduced a bug which was [fixed in 1.4.13](https://github.com/pear/Archive_Tar/pull/36). Therefore we have set the first-patched-version to `1.4.13` which the earliest working version that avoids this vulnerability.

Affected packages

EcosystemPackageAffectedFixed in
composerpear/archive_tar<= 1.4.111.4.13

Affected products

VendorProductAffected versions
PhpArchive Tar
through 1.4.11
FedoraprojectFedora
Versions 32, 33, 34, 35
DebianDebian Linux
Versions 9.0, 10.0
DrupalDrupal
from 7.0 before 7.78
from 8.9.0 before 8.9.13
from 9.0.0 before 9.0.11
from 9.1.0 before 9.1.3

Weakness classification

CWE-22CWE-59

References