Skip to content
OpenAdvisories
Unscored DRUPAL-CORE-2021-001

The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For more information pleas…

Published Jan 20, 2021 · Updated Sep 19, 2026 · Assigned by DRUPAL

Package: drupal/core Ecosystem: Packagist

Description

The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For more information please see:

* [CVE-2020-36193](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36193)

Exploits may be possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2`, or `.tlz` file uploads and processes them.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/core >= 8.0.0, < 8.9.13 · >= 9.0.0, < 9.0.11 · >= 9.1.0, < 9.1.3 8.9.13, 9.0.11, 9.1.3 DRUPAL-CORE-2021-001

References