CVE-2020-36193: PEAR Archive_Tar Improper Link Resolution Vulnerability

High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 70.6% chance of exploitation in the next 30 days.

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Drupal Drupal: from 7.0, before 7.78 (fixed in 7.78); from 8.9.0, before 8.9.13 (fixed in 8.9.13); from 9.0.0, before 9.0.11 (fixed in 9.0.11); from 9.1.0, before 9.1.3 (fixed in 9.1.3)
• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only; version 35 only
• PHP Archive Tar: up to and including 1.4.11

Published 2021-01-18. Last modified 2026-06-17.