CyberSec.Space Logo
Back to CVE Browser

CVE-2020-36193

🔥 Known Exploited (CISA KEV)HIGH
7.5
CVSS Severity Score
EPSS Score56.0900%
EPSS Percentile97.66th
Published2021-01-18
Last Modified2025-11-07
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Affected Platforms (CPE)

📦
Php

Archive Tar

<= 1.4.11
💻
Fedoraproject

Fedora

= 32= 33= 34= 35
💻
Debian

Debian Linux

= 9.0= 10.0
📦
Drupal

Drupal

>= 7.0 and < 7.78>= 8.9.0 and < 8.9.13>= 9.0.0 and < 9.0.11>= 9.1.0 and < 9.1.3

References & Advisories

🔗 https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
🔗 https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
🔗 https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
🔗 https://security.gentoo.org/glsa/202101-23

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 30, 2026

Today’s threat intelligence covers Ruby on Rails CVE-2026-66066 arbitrary file read, Gitea CVE-2026-60004 Git hook command execution, coordinated attacks on Minnesota water systems, Ruflo MCP Bridge RCE, and Firefox CVE-2026-10702.

2026-07-30

Daily Global Cyber Threat Intelligence Digest — July 29, 2026

Today’s threat intelligence covers active exploitation of Arista VeloCloud CVE-2026-16812, unauthenticated TeamCity RCE CVE-2026-63077, exposed IPMI/BMC password risks, and the Origin Energy and MCBS breach updates.

2026-07-29

Daily Global Cyber Threat Intelligence Digest — July 28, 2026

Today’s threat intelligence covers the Certighost CVE-2026-54121 AD CS domain-takeover chain, vBulletin CVE-2026-61511 pre-auth RCE, the expanding Dysphoria botnet, and the DentaQuest and Fairlife breach updates.

2026-07-28

Related Vulnerabilities

CVE-2026-419399.3

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management inte...

CVE-2026-137236.5

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on...

CVE-2026-547278.2

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries wh...

CVE-2026-545748.2

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root...