CVE-2020-36193

What is PEAR Archive_Tar?

PEAR (PHP Extension and Application Repository) is a long-standing distribution system for reusable PHP components, and Archive_Tar is one of its most widely embedded libraries — used to create and extract .tar archives from PHP code. It's bundled inside Drupal core, various Red Hat Enterprise Linux packages, and numerous other PHP applications that need archive handling, often as a dependency administrators never explicitly chose or are aware of running.

Overview

CVE-2020-36193 is a path traversal vulnerability (CWE-22) in Archive_Tar's Tar.php, caused by inadequate validation of symbolic links contained within a tar archive during extraction. An attacker who can get a vulnerable application to extract a malicious tar archive — for instance, a Drupal module or theme package — can use a crafted symbolic link entry to write files outside the intended extraction directory (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High).

Technical Details

When extracting a tar archive, Archive_Tar processes symbolic link entries without sufficiently verifying that the link's target stays within the intended extraction path. A malicious archive can define a symlink pointing outside the extraction directory, and subsequent file writes that follow that link land wherever the attacker chose — potentially overwriting sensitive files elsewhere on the filesystem, depending on the permissions of the process performing the extraction. This CVE is one of a related cluster of Archive_Tar fixes from this period, alongside CVE-2020-28948 (a similar path-traversal issue) and CVE-2020-28949 (a PHAR-related deserialization bug in the same library, also enriched on this site).

Discovery

Reported through PEAR's standard bug-tracking process and fixed in the upstream Archive_Tar repository, with Drupal shipping SA-CORE-2021-001 to update its bundled copy of the library for affected sites.

Exploitation Context

Because Archive_Tar is a transitive dependency embedded in Drupal and other widely-deployed PHP software, this vulnerability class illustrates the same "hidden dependency" risk seen in Log4Shell — site administrators running Drupal may not have realized their exposure depended on a bundled third-party archive library rather than Drupal's own code. CISA added the CVE to KEV in August 2022 based on confirmed exploitation.

Remediation

1. Update Archive_Tar to the patched version directly, or update Drupal core to a release that bundles the fixed library (per SA-CORE-2021-001).
2. Audit any other PHP applications in your environment for a bundled or standalone Archive_Tar dependency — this library ships inside many PHP projects beyond Drupal.
3. Restrict who can upload modules, themes, or archives to any application using Archive_Tar for extraction, since exploitation requires getting a malicious archive extracted by the vulnerable code.
4. Run archive-extraction processes with the minimum filesystem permissions necessary, limiting the damage a symlink-traversal write could cause even if the library itself remains unpatched temporarily.