Skip to content
Log inStart free trial

DRUPAL-CORE-2021-004 CVE-2021-32610 GHSA-p8q8-jfcv-g2h2

Directory Traversal in Archive_Tar

High Packagist
Severity
7.1 / 10
High · CVSS 3.1
Exploit chance (EPSS)
73.38%
Chance of exploitation in the next 30 days. Higher than 99.46% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-59 Improper Link Resolution Before File Access ('Link Following')
Fix
Available
2 packages have a fixed version

Description

The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal.

The vulnerability is mitigated by the fact that Drupal core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks.

Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source.

This advisory is not covered by Drupal Steward.

Affected versions

Packagist

PackageVulnerableFixed in
drupal/core
>= 8.0.0, < 8.9.17
>= 9.1.0, < 9.1.11
>= 9.2.0, < 9.2.2
8.9.17
9.1.11
9.2.2
pear/archive_tar
< 1.4.14
1.4.14

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → 9.2.2

composer
composer require drupal/core:^9.2.2

pear/archive_tar Packagist → 1.4.14

composer
composer require pear/archive_tar:^1.4.14

Severity breakdown

CVSS 3.1 7.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-59: Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

How to prevent it
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Critical Known exploited Also affects drupal/core
CVE-2020-36193
Directory Traversal in Archive_Tar
High Known exploited Also affects pear/archive_tar
CVE-2020-28949
Multiple vulnerabilities through filename manipulation in Archive_Tar
High Known exploited Also affects drupal/core
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
High Known exploited Also affects drupal/core
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
High Known exploited Also affects drupal/core
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Not rated yet Also affects drupal/core

Credits: Drew Webber

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor