High 1 exploited CVE USN-4723-1 1 CVE

php-pear vulnerability

Published Feb 8, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PEAR incorrectly handled symbolic links in archives.
A remote attacker could possibly use this issue to execute arbitrary code.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	php-pear	1:1.10.1+submodules+notgz-6ubuntu0.3
Ubuntu · 18.04 LTS 18.04:LTS	php-pear	1:1.10.5+submodules+notgz-1ubuntu1.18.04.3
Ubuntu · 20.04 LTS 20.04:LTS	php-pear	1:1.10.9+submodules+notgz-1ubuntu0.20.04.2

Vulnerabilities 1

High 7.5

CVE-2020-36193 Exploited EPSS 71%

Directory Traversal in Archive_Tar

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist

Jan 18, 2021
KEV Aug 25, 2022

References

report
https://ubuntu.com/security/CVE-2020-36193