CVE-2020-36193
Archive_Tar: directory traversal due to inadequate checking of symbolic links
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 27, 2021
Updated · November 21, 2025
Description
A flaw was found in the Archive_Tar package. Archive_Tar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences (/../) to modify arbitrary files on the system.
Statement
php-pear 7.2 and 7.3 have been marked End of Life at the time this CVE was released. Therefore no patches would be made available for those versions.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')