GitHub Advisoryadvisory · Packagist

GHSA-rpw6-9xfx-jvcx Directory Traversal in Archive_Tar

HIGH Published 2021-04-22 Modified 2025-10-22 Official page ↗
Aliases
CVE-2020-36193
Ecosystem
Packagist
Packages
pear/archive_tar
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:H
Weaknesses
CWE-22, CWE-59
Reviewed
2021-03-22

Affected packages

• Packagist pear/archive_tar: < 1.4.13 → fixed in 1.4.13

Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. :exclamation: Note: There was an initial fix for this vulnerability made in version `1.4.12`. That fix introduced a bug which was fixed in 1.4.13. Therefore we have set the first-patched-version to `1.4.13` which the earliest working version that avoids this vulnerability.

Related

Alias · CVE (1)

  • CVE-2020-36193 Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References