CVE-2020-36193 KEV High · 7.5 EPSS 70.6%

PEAR Archive_Tar Improper Link Resolution Vulnerability

PEAR · Archive_Tar

Summary

The PEAR Archive_Tar component (product Archive_Tar, vendor PEAR) has an improper link-resolution flaw in Tar.php, present through version 1.4.11, where symbolic links are inadequately checked during write operations, allowing directory traversal. An unauthenticated remote attacker with network access can exploit it without user interaction, provided the application processes an attacker-supplied tar archive that is written out using Archive_Tar, causing files to be written outside the intended directory.

Official description · NVD

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Breakdown

73.1 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Tamper with stored dataT1565.001 · Stored Data ManipulationAI-written (claude-haiku-5-5)Medium confidence6 general detection rules

First seen exploited 19 months after disclosure.

Disclosed18 Jan 2021day 0
First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees25 Aug 2022+19 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

5 related vulnerabilities in the same code over 3 years. The latest fix listed for pear/archive_tar is 1.4.14.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502…27 Dec 2018
relatedHigh
Why these are linked:
- Fixed one release later1.4.4 → 1.4.11 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)Functions: _tarRecToSizecommit 59ace12 commit 0670a05
CVE-2020-28948Archive_Tar through 1.4.10 allows an unserialization attack…19 Nov 2020
same family
CVE-2020-28949PEAR Archive_Tar Deserialization of Untrusted Data19 Nov 2020KEV
Next fix in the same packageHigh
Why these are linked:
- Fixed one release later1.4.11 → 1.4.13 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)commit 0670a05 commit cde4605
This CVECVE-2020-36193PEAR Archive_Tar Improper Link Resolution18 Jan 2021KEV
relatedHigh
Why these are linked:
- Fixed one release later1.4.13 → 1.4.14 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)Functions: _extractListcommit cde4605 commit b583243 commit 7789ebb
CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets…27 Jul 2021

Fixes in pear/archive_tarPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.4.4CVE-2018-100088827 Dec 2018
1.4.11CVE-2020-2894819 Nov 2020
1.4.11CVE-2020-2894919 Nov 2020KEV
1.4.13CVE-2020-3619318 Jan 2021KEV
1.4.14CVE-2021-3261027 Jul 2021Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Crafted archive processed by app enables traversal

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal

From the official description (NVD) Original ↗

ImpactTA0040

Stored Data Manipulation T1565.001 Medium

AI mapping from the description · primary impact

Arbitrary file writes alter stored data

allows write operations with Directory Traversal due to inadequate checking of symbolic links

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 155 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-36193 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Stored Data ManipulationT1565.0016 general rules

Commands to Clear or Remove the Syslog - Builtinhightest
History File Deletionhightest
Azure Device or Configuration Modified or Deletedmediumtest
Azure DNS Zone Modified or Deletedmediumtest
Cisco Denial of Servicemediumtest
Potential Suspicious Change To Sensitive/Critical Filesmediumtest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: pear/archive_tar.

Packagistpear/archive_tarGHSA-rpw6-9xfx-jvcx

Upgrade to 1.4.14 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-28949, CVE-2021-32610).

Set the version to 1.4.14 or later in your composer.json.

First fixed in 1.4.13 for CVE-2020-36193.

Affected versions

If you run	Upgrade to
All versions before 1.4.13	1.4.14first fix for this CVE: 1.4.13

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

11 links, grouped by NVD tag (10 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 25 Aug 2022. Federal due date 15 Sep 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 25 Aug 2022. EUVD-2021-0874

No public exploit code found.

, 30 Oct 2026

70.6%Top 0.61%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.39%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1528 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9939 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total73.1

Record

Published: 18 Jan 2021
Modified: 17 Jun 2026
: CWE-22 Improper Limitation of a Pathname to a Restricted DirectoryCWE-59 Improper Link Resolution Before File Access
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in pear/archive_tarPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Patch 1

US Government Resource 1

Third Party Advisory 5

Broken Link 4

How attackers get in

What they do

techniques