Archive Tar

archive_tar

Vendor: Php • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-32610 3Debian FedoraprojectPhp 3Archive Tar Debian LinuxFedora Nov 21, 2024 Jul 30, 2021 N/A· v4 7.1 HIGH· v3 3.6 LOW· v2 In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
CVE-2020-36193 4Debian DrupalFedoraproject+1 more 4Archive Tar Debian LinuxDrupal+1 more Nov 7, 2025 Jan 18, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-28949 4Debian DrupalFedoraproject+1 more 4Archive Tar Debian LinuxDrupal+1 more Nov 7, 2025 Nov 19, 2020 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVE-2020-28948 4Debian DrupalFedoraproject+1 more 4Archive Tar Debian LinuxDrupal+1 more Nov 21, 2024 Nov 19, 2020 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.