PEAR Archive_Tar Directory Traversal and Arbitrary File Write via Symlink Verification Bypass (CVE-2020-36193)
Executive & SecOps Summary
SECOPS ASSESSMENTPHP applications and frameworks (including Drupal) utilizing PEAR Archive_Tar versions 1.4.11 and prior
Remote attackers can exploit inadequate symbolic link validation to perform directory traversal, writing arbitrary files to the system and potentially achieving Remote Code Execution (RCE)
Immediately upgrade the PEAR Archive_Tar package to version 1.4.12 or higher, and restrict archive file uploads and extraction paths
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade the Archive_Tar library to the patched version (1.4.12 or higher) using the PEAR package manager or Composer.
# Upgrade using PEAR package manager
pear upgrade archive_tar
# Upgrade using Composer for PHP projects
composer update pear/archive_tar --with-dependencies2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, temporarily disable archive upload and extraction features. Additionally, restrict PHP's file system access using the open_basedir directive in your php.ini configuration to prevent scripts from accessing unauthorized directories.
# Add to php.ini to restrict file system access and mitigate traversal\open_basedir = '/var/www/html:/tmp'3. Log Audit & IoC Verification Commands
Use the following commands to verify the installed version of Archive_Tar and scan for suspicious symbolic links in your upload directories.
# 1. Check the installed version via Composer
composer show pear/archive_tar | grep -E 'versions'
# 2. Scan the upload directory for unauthorized symbolic links
find /var/www/html/uploads -type l -lsScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-36193) exists in the Tar.php module of the PEAR Archive_Tar library, a widely used PHP component for handling Tar archives. The root cause is the library's inadequate validation of symbolic links during the extraction process. When processing a specially crafted Tar archive containing symbolic links, the application fails to verify if the target path points outside the intended extraction directory, leading to a Directory Traversal vulnerability.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious Tar archive containing a symbolic link that points to a sensitive directory (e.g., ../../../../var/www/html). When the vulnerable application extracts this archive, the symbolic link is created first. Subsequent files in the archive are then extracted through this symbolic link, allowing the attacker to write arbitrary files (such as a PHP WebShell) into the web root or overwrite critical system configuration files, leading to full application compromise.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and carries a high EPSS score (exceeding 0.70), it represents an active and highly critical threat. Successful exploitation allows attackers to execute arbitrary PHP code under the privileges of the web server process. This can lead to database credential theft, lateral movement within the internal network, ransomware deployment, and complete system takeover, severely impacting business continuity.
Official Vendor Advisories & References
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Frequently Asked SecOps Questions (CVE-2020-36193)
FAQQ1. How critical is CVE-2020-36193 and is it actively exploited in the wild?
CVE-2020-36193 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 70.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-36193?
Primary impacted vendors include pear across archive_tar. Scope summary: PEAR Archive_Tar versions 1.4.11 and earlier (including downstream integrations like Drupal)
Q3. What temporary mitigations or workarounds exist for CVE-2020-36193 before patching?
[Mitigation] Immediately upgrade the PEAR Archive_Tar package to version 1.4.12 or higher, and restrict archive file uploads and extraction paths Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-36193
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (pear)
View Category →GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384) Security Advisory: Arbitrary File Write via Docker Cache Path
[Affected Scope] JFrog Artifactory Self-Managed instances under specific remote-repository conditions
sevenz-rust2 Path Traversal and Arbitrary File Overwrite Vulnerability (CVE-2026-61725)
[Affected Scope] Rust applications utilizing sevenz-rust2 library versions prior to 0.21.1.
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.