CVE-2020-36193

PEAR Archive_Tar through 1.4.11 mishandles symbolic links when unpacking archives, allowing write operations with directory traversal (CWE-22/CWE-59; a related issue to CVE-2020-28948). An attacker who can get a vulnerable application to extract a crafted .tar archive can slip symlinks past the checks in Tar.php and write files outside the intended extraction directory with the privileges of the PHP process, an arbitrary file-write condition with high integrity impact and the potential for supply-chain-style compromise given how widely the library is embedded. Anyone running PHP applications that use Archive_Tar to unpack user-supplied archives is affected, including Drupal, which bundles the library, plus systems with the library packaged in Debian or Fedora. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-25, and EPSS estimates a ~71% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but KEV listing confirms observed exploitation in the wild.

What to do: Upgrade PEAR Archive_Tar to 1.4.12 or later (the first release after the affected range through 1.4.11) and pull in the corresponding updates from Debian, Fedora, and Drupal per vendor advisories. Audit whether your PHP applications extract user-supplied .tar archives via Archive_Tar and, until patched, restrict or validate symlink handling in extraction paths. This vulnerability is on CISA's KEV list, so apply the required vendor updates promptly.