# pear/archive\_tar (Packagist) vulnerabilities

6 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/pear/archive_tar

## Advisories (6)

### [CVE-2021-32610](https://cve.now/CVE-2021-32610): In Archive\_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

- Severity: Unrated
- Published: Jul 27, 2021
- Affected: fixed in 1.4.14.

### [CVE-2020-36193](https://cve.now/CVE-2020-36193): Tar.php in Archive\_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relat

- Severity: High 7.5 · KEV
- Published: Jan 18, 2021
- Affected: fixed in 1.4.13.

### [CVE-2020-28948](https://cve.now/CVE-2020-28948): Archive\_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

- Severity: Unrated
- Published: Nov 19, 2020
- Affected: fixed in 1.4.11.

### [CVE-2020-28949](https://cve.now/CVE-2020-28949): Archive\_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fil

- Severity: High 7.8 · KEV
- Published: Nov 19, 2020
- Affected: fixed in 1.4.11.

### [CVE-2018-1000888](https://cve.now/CVE-2018-1000888): PEAR Archive\_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive\_Tar class.

- Severity: Unrated
- Published: Dec 27, 2018
- Affected: fixed in 1.4.4.

### [CVE-2006-0931](https://cve.now/CVE-2006-0931): Directory traversal vulnerability in PEAR::Archive\_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and…

- Severity: Unrated
- Published: Feb 28, 2006
- Affected: from 1.2, fixed in 1.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/pear/archive_tar
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.