Vulnerability advisory

GHSA-rpw6-9xfx-jvcx

Directory Traversal in Archive_Tar

Published Apr 22, 2021Updated Oct 22, 2025OSV record ↗

Also known as BIT-drupal-2020-36193CVE-2020-36193

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:H

Affected versions

pear/archive_tar Packagist

All pear/archive_tar advisories →

Affected	Fixed in
All versions before 1.4.13	`1.4.13`Advisories →
Also listed as affected (19) `1.3.11` `1.3.12` `1.3.13` `1.3.14` `1.3.15` `1.3.16` `1.4.0` `1.4.1` `1.4.10` `1.4.11` `1.4.12` `1.4.2` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.4.9`

Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

:exclamation: Note:

There was an initial fix for this vulnerability made in version 1.4.12. That fix introduced a bug which was fixed in 1.4.13. Therefore we have set the first-patched-version to 1.4.13 which the earliest working version that avoids this vulnerability.

GHSA-rpw6-9xfx-jvcx

Affected versions

pear/archive_tar Packagist

Description

:exclamation: Note:

References