Security readout for executives and security teams
Plain-English summary
Archive_Tar could write files outside the intended destination when handling crafted tar archives with symbolic links. For a business, the concern is unauthorized file modification on systems that process untrusted archives. CISA KEV status means defenders should treat exposure as urgent, but the provided sources do not describe specific exploitation campaigns.
Executive priority
Prioritize remediation for internet-facing or user-upload systems first. KEV status raises urgency, but risk depends on whether the organization processes untrusted tar archives with vulnerable Archive_Tar code.
Technical view
CVE-2020-36193 is a CWE-59 symbolic-link following issue in Tar.php in PEAR Archive_Tar through 1.4.11. The CVSS 3.1 vector is network, low complexity, no privileges, no user interaction, unchanged scope, high integrity impact. It is related to CVE-2020-28948 and affects write operations during archive handling.
Likely exposure
Most likely exposed systems are PHP applications, CMS deployments, or Linux packages that include PEAR Archive_Tar through 1.4.11 and extract attacker-controlled tar archives. Drupal and multiple distribution advisories indicate downstream packaged exposure, but the bundle does not provide a complete affected-product inventory.
Exploitation context
CISA KEV inclusion supports known exploitation. The source bundle does not provide exploit volume, target sectors, public exploit details, or campaign attribution. The practical risk is highest where archive extraction accepts remote or untrusted input and runs with permissions that can modify sensitive files.
Researcher notes
Focus validation on symlink handling during write or extraction paths. The public bundle confirms the vulnerability class, affected upper version, CVSS vector, and downstream advisories, but not a full product matrix or exploit mechanics.
Mitigation direction
- Identify PEAR Archive_Tar versions and downstream packages in PHP applications and server images.
- Upgrade affected Archive_Tar through 1.4.11 using vendor-fixed packages or confirmed upstream fixes.
- Apply relevant Drupal, Debian, Gentoo, and Fedora security updates where applicable.
- Restrict or disable extraction of untrusted tar archives until patching is complete.
- Run archive extraction with least-privilege filesystem permissions.
Validation and detection
- Inventory Composer, PEAR, OS package, and CMS dependencies for Archive_Tar usage.
- Confirm no deployed instance reports Archive_Tar version 1.4.11 or earlier unless vendor-backported.
- Review upload and import workflows that extract tar archives from external users.
- Check application file integrity around writable directories and configuration paths.
- Verify vendor advisory updates are installed in each affected environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-36193 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916CVE reference · x_refsource_MISC
- https://www.drupal.org/sa-core-2021-001CVE reference · x_refsource_CONFIRM
- [debian-lts-announce] 20210121 [SECURITY] [DLA-2530-1] drupal7 security updateCVE reference · mailing-list, x_refsource_MLIST
- GLSA-202101-23CVE reference · vendor-advisory, x_refsource_GENTOO
- FEDORA-2021-02996612f6CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-dc7de65eedCVE reference · vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20210408 [SECURITY] [DLA 2621-1] php-pear security updateCVE reference · mailing-list, x_refsource_MLIST
- DSA-4894CVE reference · vendor-advisory, x_refsource_DEBIAN
- FEDORA-2021-8093e197f4CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-0c013f520cCVE reference · vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.