CVE-2020-36193: PEAR Archive_Tar Improper Link Resolution Vulnerability

CVE-2020-36193 is an improper link resolution flaw in PEAR Archive_Tar, specifically in Tar.php, that allows write operations combined with directory traversal because symbolic links are not checked adequately. PEAR (PHP Extension and Application Repository) supplies reusable PHP components and appears in third-party products such as Drupal Core and Red Hat Linux environments. For defenders this matters because archive extraction is a common path into web and application servers; a successful abuse can let an attacker write outside the intended directory and potentially plant or overwrite files.

CISA lists the required action as applying updates per vendor instructions. Ransomware use is not documented for this CVE. Confirm all version, configuration, and fix details against the vendor advisory before acting.

How it works

The weakness maps to CWE-22 (path traversal) and CWE-59 (improper link resolution). Archive_Tar processes tar archives; when it encounters symbolic links, insufficient validation lets a crafted archive cause write operations that escape the target extraction directory. An attacker who can supply or influence a tar file processed by a vulnerable component can therefore direct writes to unexpected locations on the filesystem.

Exact exploit mechanics, required privileges, and attack preconditions are not detailed in the supplied facts. Treat any untrusted archive input to PHP applications that use Archive_Tar as a potential vector, and verify behavior and impact against the vendor advisory for your specific deployment.

Am I affected? How to find it in your systems

PEAR Archive_Tar is a PHP library. It commonly appears wherever PEAR packages or PHP applications that extract tar archives are installed, including sites and appliances built on Drupal Core and systems distributed with Red Hat Linux that bundle the component. Inventory should cover application servers, CMS instances, custom PHP codebases, and package-managed PHP environments.

• Search package inventories and composer/PEAR dependency lists for Archive_Tar or pear/archive_tar.
• On hosts that use system PHP packages, query the package manager for PEAR-related packages and note the Archive_Tar version present.
• Review Drupal and other CMS plugin/module inventories for components that depend on PEAR Archive_Tar.
• Identify any automated or user-facing workflows that accept and extract tar archives in PHP.

Which exact versions are vulnerable must be confirmed against the vendor advisory; do not assume a version is safe without that check. Telemetry signs of exploitation are not specified in the facts; look for unexpected file writes outside extraction directories, anomalous tar processing errors, or new files appearing in sensitive paths after archive handling, and correlate with application logs that record archive uploads or extractions.

How to remediate

Patch first. Apply the updates provided by the vendor for PEAR Archive_Tar (and for any product that embeds it, such as Drupal Core or Red Hat packages) following the vendor’s instructions, as required by CISA. After updating, re-check dependency trees and package versions to confirm the fixed component is what is actually loaded at runtime.

• Rebuild or redeploy applications so they pick up the patched library rather than a cached or vendored copy.
• Where you control extraction logic, restrict the target directory, reject archives that contain symbolic links when your use case does not require them, and run extraction under a least-privilege account.
• Prefer well-maintained archive libraries and keep PEAR/PHP dependencies in regular patch cycles.

Hardening for this class also includes validating and limiting archive sources and monitoring extraction paths for unexpected writes.

If you can't patch immediately

Until the vendor update is applied, reduce exposure with compensating controls:

• Segment systems that process untrusted archives so a successful write cannot reach high-value hosts or data stores.
• Disable or tightly gate any feature that accepts and extracts tar files from untrusted users until the library is patched.
• If a web application firewall or virtual patching layer can inspect uploads, block or quarantine tar archives that contain symbolic links or suspicious path components; tune rules carefully and confirm they match your traffic.
• Run PHP workers that perform extraction with minimal filesystem permissions and a dedicated extraction directory that is not web-accessible.
• Increase monitoring on extraction directories and sensitive paths for unexpected file creation or modification, and alert on archive-processing errors.

These steps lower risk but do not replace the vendor update. Schedule the official fix as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities can lead to unauthorized file writes and broader compromise. If you have evidence of exploitation or suspect archives were processed by a vulnerable instance, follow your incident response process: isolate affected hosts, preserve logs, and assess what was written or altered. Ransomware use is not documented for this CVE. You can run a free exposure scan of your email addresses against known breach data to see whether associated credentials or identities have appeared in prior breaches, then force password resets and review access where appropriate.