{"id":"CVE-2020-36193","kind":"vulnerability","aliases":["CVE-2020-36193"],"related":[],"title":"Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of…","description":"PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.\n\nCISA required action: Apply updates per vendor instructions.","summary":"PEAR Archive_Tar, a PHP library for reading and writing tar archives, does not check symbolic links properly, allowing writes outside the intended directory during extraction. An attacker who supplies a crafted tar archive can write files to arbitrary locations the PHP process can reach.","severity":"high","cvss":7.5,"epss":0.70595,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"PEAR Archive_Tar","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"php archive tar","fixed":[],"affected":"<= 1.4.11","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 32","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 33","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 34","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 35","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"drupal","fixed":["7.78"],"affected":">= 7.0, < 7.78","ecosystem":"vendor"},{"name":"drupal","fixed":["8.9.13"],"affected":">= 8.9.0, < 8.9.13","ecosystem":"vendor"},{"name":"drupal","fixed":["9.0.11"],"affected":">= 9.0.0, < 9.0.11","ecosystem":"vendor"},{"name":"drupal","fixed":["9.1.3"],"affected":">= 9.1.0, < 9.1.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["archive_tar","drupal","exploited","package","pear","php"],"not_affected_if":["archive_tar-not-installed","no-untrusted-archives"],"how_to_check":null,"fix":"Upgrade PEAR Archive_Tar to a fixed version (fixed version not stated in sources); check the vendor advisory for the exact release.","status":"open","published_at":"2021-01-18T20:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:10:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade PEAR Archive_Tar to a fixed version (fixed version not stated in sources); check the vendor advisory for the exact release.","reach":"unknown","impact":"high","summary":"PEAR Archive_Tar, a PHP library for reading and writing tar archives, does not check symbolic links properly, allowing writes outside the intended directory during extraction. An attacker who supplies a crafted tar archive can write files to arbitrary locations the PHP process can reach.","category":"package","who_cares":["php","pear","archive_tar","drupal"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker writes files outside extraction directory, possibly achieving code execution.","analyst_note":"Find the fixed Archive_Tar version and the exact extraction-path check to run, from the CISA KEV entry and the PEAR/Archive_Tar advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-archives","archive_tar-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000489,"input_tokens":2898,"output_tokens":399,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':18A,21A '-36193':19A,22A '1.4.11':6A 'action':155C 'allow':7A,70B,101C 'appli':156C 'applic':120C 'arbitrari':90B 'archiv':3A,45B,53B,63B,85B,98C 'archive':24A,27A 'attack':79B 'check':16A,66B,110C 'cisa':153C 'compon':136C 'core':148C 'craft':83B 'cve':17A,20A 'debian':37A,39A 'directori':11A,75B,105C 'distribut':131C 'drupal':41A,42A,43A,44A,47B,147C 'due':13A,107C 'exploit':48B 'extens':118C 'extract':77B 'fedora':30A,32A,34A,36A 'fedoraproject':29A,31A,33A,35A 'file':88B 'framework':129C 'hat':151C 'inadequ':15A,109C 'instruct':160C 'intend':74B 'known':138C 'librari':57B 'link':68B,113C 'linux':38A,40A,152C 'locat':91B 'open':127C 'open-sourc':126C 'oper':9A,103C 'outsid':72B 'packag':49B 'parti':143C 'pear':23A,50B,52B,97C,114C 'per':158C 'php':26A,51B,56B,93B,117C,135C 'process':94B 'product':144C 'proper':69B 'reach':96B 'read':59B 'red':150C 'repositori':121C 'requir':154C 'reusabl':134C 'sourc':128C 'stand':115C 'suppli':81B 'symbol':67B,112C 'system':132C 'tar':4A,25A,28A,46B,54B,62B,84B,99C 'tar.php':1A,100C 'third':142C 'third-parti':141C 'travers':12A,106C 'updat':157C 'usag':139C 'vendor':159C 'write':8A,61B,71B,87B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-01-18T20:15:12+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-36193","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-36193","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"epss","external_id":"CVE-2020-36193","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-36193","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-36193","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36193","severity":null,"published_at":"2021-01-18T20:15:12+00:00","modified_at":"2026-06-17T03:14:58+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}