{"schema":"threatline.record/2","record":{"id":"CVE-2020-36193","aliases":[],"summary":"PEAR Archive_Tar Improper Link Resolution Vulnerability","details":"PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","categories":["Unclassified"],"product":"Archive_Tar","vendor":"PEAR","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-36193","source_modified_at":"2025-10-21T23:35:29.738Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":true,"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.70595,"percentile":0.99394,"score_date":"2026-10-23"},"published_at":"2021-01-18T19:24:18.000Z","modified_at":"2025-10-21T23:35:29.738Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2020-36193","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:35:29.738Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-36193","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","EPSS"],"references":[{"url":"https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916, https://www.drupal.org/sa-core-2021-001, https://access.redhat.com/security/cve/cve-2020-36193","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36193","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.drupal.org/sa-core-2021-001","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"source":"CVE List","url":"https://security.gentoo.org/glsa/202101-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"source":"CVE List","url":"https://www.debian.org/security/2021/dsa-4894","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"partial","assessed_at":"2025-02-04T20:21:16.325750Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-10-21T23:35:29.738Z","content_hash":"00ad57762d865a238c678bd4690022409023bcbfd8d9157a0a268a462cfe3100"}}