CVE-2020-36193 kev in the critical feed json
Directory Traversal in Archive_Tar
published 2021-01-18 5 y ago modified 2026-09-08 2 mo ago also BIT-drupal-2020-36193 , EUVD-2021-0874 , GHSA-rpw6-9xfx-jvcx
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-08-25
- epss
- 70.6%
- EPSS 70.6% chance of exploitation in 30 days, percentile 99.3%
- public exploits
- 0
- none known
Summary
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Patch / fix
cisa required action Apply updates per vendor instructions.
- packagist pear/archive_tar 1.4.13
- bitnami drupal 7.78.0, 8.9.13, 9.0.11, 9.1.3
- drupal drupal 7.78, 8.9.13, 9.0.11, 9.1.3
- php-pear Debian 14, Debian 13, Debian 12 1:1.10.12+submodules+notgz+20210212-1
debian advisories DEBIAN-CVE-2020-36193
- php-pear Ubuntu 16.04 LTS 1:1.10.1+submodules+notgz-6ubuntu0.3
- php-pear Ubuntu 18.04 LTS 1:1.10.5+submodules+notgz-1ubuntu1.18.04.3
- php-pear Ubuntu 20.04 LTS 1:1.10.9+submodules+notgz-1ubuntu0.20.04.2
ubuntu advisories UBUNTU-CVE-2020-36193
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- php-pear RHEL 7 1:1.9.4-23.el7_9
- libzip RHEL 8, RHEL 8.4 EUS 1.6.1-1.module+el8.3.0+6678+b09f589e
- php RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
- php-gd RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
- php-cli RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
- php-dba RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
- php-dbg RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
- php-ffi RHEL 8 7.4.19-4.module+el8.6.0+16316+906f6c6d
red hat advisories RHSA-2022:7340RHSA-2022:6541RHSA-2022:6542
- php7-pear SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 1.10.21-3.6.1
- php74-pear SLE Module for Web and Scripting 12 1.10.21-1.6.1
- php72 SLE Software Development Kit 12 SP5, SLE Module for Web and Scripting 12 7.2.5-1.69.1
suse advisories SUSE-SU-2021:3018-1SUSE-SU-2021:3006-1SUSE-SU-2021:2926-1
- php7-pear openSUSE Leap 15.2 1.10.21-lp152.2.6.1
- php7-pear openSUSE Leap 15.3 1.10.21-3.6.1
- php7 openSUSE Leap 15.3 7.2.5-4.82.1
opensuse advisories openSUSE-SU-2021:1267-1openSUSE-SU-2021:3018-1openSUSE-SU-2021:2872-1
- php AlmaLinux 8 7.4.19-4.module_el8.6.0+3238+624bf8b8
- php AlmaLinux 8 7.4.19-4.module_el8.6.0+3239+bedf0508
- libzip AlmaLinux 8 1.6.1-1.module_el8.6.0+2750+78feabcb
- libzip AlmaLinux 8 1.6.1-1.module_el8.6.0+3239+bedf0508
- php-gd AlmaLinux 8 7.4.19-4.module_el8.6.0+3238+624bf8b8
- php-gd AlmaLinux 8 7.4.19-4.module_el8.6.0+3239+bedf0508
- php-cli AlmaLinux 8 7.4.19-4.module_el8.6.0+3239+bedf0508
- php-cli AlmaLinux 8 7.4.19-4.module_el8.6.0+3238+624bf8b8
almalinux advisories ALSA-2022:6542
- php Rocky Linux 8 7.4.19-4.module+el8.6.0+1006+0d5a469f
- libzip Rocky Linux 8 1.6.1-1.module+el8.6.0+789+2130c178
- libzip Rocky Linux 8 1.6.1-1.module+el8.4.0+415+e936cba3
- php-pear Rocky Linux 8 1:1.10.13-1.module+el8.7.0+1067+0a7071cc
- php-pear Rocky Linux 8 1:1.10.13-1.module+el8.6.0+1006+0d5a469f
- php-pecl-rrd Rocky Linux 8 2.0.1-1.module+el8.4.0+414+2e7afcdd
- php-pecl-zip Rocky Linux 8 1.18.2-1.module+el8.6.0+789+2130c178
- php-pecl-zip Rocky Linux 8 1.18.2-1.module+el8.4.0+415+e936cba3
rocky linux advisories RLSA-2022:6542
- drupal7 Alpine 3.20, Alpine 3.19, Alpine 3.18 +6 more 7.78-r0
alpine advisories ALPINE-CVE-2020-36193
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-36193 updated cvss 7.5
Archive_Tar: directory traversal due to inadequate checking of symbolic links
-
Red Hat Enterprise Linux 6 php-pearaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 php-pear Red Hat Software Collections rh-php73-php-pearaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 8) php 7.4.19-4.module+el8.6.0+16316+906f6c6d, libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php-gd 7.4.19-4.module+el8.6.0+16316+906f6c6d, php-cli 7.4.19-4.module+el8.6.0+16316+906f6c6d, php-dba 7.4.19-4.module+el8.6.0+16316+906f6c6d, php-dbg 7.4.19-4.module+el8.6.0+16316+906f6c6d, +28 morefixed: vendor fix RHSA-2022:6542
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) php 7.4.6-5.module+el8.4.0+15727+276bb227, libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php-gd 7.4.6-5.module+el8.4.0+15727+276bb227, php-cli 7.4.6-5.module+el8.4.0+15727+276bb227, php-dba 7.4.6-5.module+el8.4.0+15727+276bb227, php-dbg 7.4.6-5.module+el8.4.0+15727+276bb227, +28 morefixed: vendor fix RHSA-2022:6541
-
Red Hat Enterprise Linux Server (v. 7) php-pear 1.9.4-23.el7_9 Red Hat Enterprise Linux Workstation (v. 7) php-pear 1.9.4-23.el7_9fixed: vendor fix RHSA-2022:7340
-
Red Hat Enterprise Linux 9 php-pearnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-09-15 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- PEAR, Archive_Tar
- CISA name
- PEAR Archive_Tar Improper Link Resolution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
70.59% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pear/archive_tar | <1.4.13 |
1.4.13 |
| bitnami | drupal | >=7.0.0, <7.78.0 >=8.9.0, <8.9.13 >=9.0.0, <9.0.11 >=9.1.0, <9.1.3 |
7.78.0 8.9.13 9.0.11 9.1.3 |
Classification
References
-
github.com
/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
web, patch
-
security.gentoo.org
/glsa/202101-23
vendor-advisory, web, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
vendor-advisory, broken-link, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
vendor-advisory, broken-link, web
-
debian.org
/security/2021/dsa-4894
vendor-advisory, web, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
vendor-advisory, broken-link, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
vendor-advisory, broken-link, web
-
drupal.org
/sa-core-2021-001
web, third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2021/01/msg00018.html
mailing-list, web, third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2021/04/msg00007.html
mailing-list, web, third-party-advisory, advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193
government-resource, web, us-government-resource
-
nvd.nist.gov
/vuln/detail/CVE-2020-36193
advisory, web
-
github.com
/pear/Archive_Tar/issues/35
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR
web
-
github.com
/pear/Archive_Tar
package
-
github.com
/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-36193.yaml
web
Sources
- CVE List CVE-2020-36193
- GitHub Advisory GHSA-rpw6-9xfx-jvcx
- NVD CVE-2020-36193
- OSV BIT-drupal-2020-36193
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.