Skip to content
OpenAdvisories

Package · Packagist

pear/archive_tar

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 7.1
    CVE-2021-32610 EPSS 73%

    Directory Traversal in Archive_Tar

    In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

    drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  • High 7.5
    CVE-2020-36193 Exploited EPSS 71%

    Directory Traversal in Archive_Tar

    Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
    KEV Aug 25, 2022
  • High 7.8
    CVE-2020-28948 Public exploit EPSS 47%

    Multiple vulnerabilities through filename manipulation in Archive_Tar

    Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

    drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  • High 8.8
    CVE-2018-1000888 Public exploit EPSS 19%

    Archive_Tar contains Potential RCE if filename starts with phar://

    PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
  • Critical 9.1
    CVE-2006-0931

    PEAR::Archive_Tar Directory Traversal vulnerability

    Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.

    pear/archive_tar Packagist