Skip to content
Log inStart free trial

GHSA-75c5-f4gw-38r9 BIT-drupal-2020-28948 BIT-drupal-2020-28949 CVE-2020-28948 DRUPAL-CORE-2020-013 GHSA-75c5-f4gw-38r9 GHSA-jh5x-hfhg-78jq

Multiple vulnerabilities through filename manipulation in Archive_Tar

High Known exploited Packagist
Severity
7.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
47.49%
Chance of exploitation in the next 30 days. Higher than 98.84% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog
Weakness
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Fix
Available
2 packages have a fixed version

Description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33

Affected versions

Packagist

PackageVulnerableFixed in
drupal/core
>= 8.0.0, < 8.8.12
>= 8.9.0, < 8.9.10
>= 9.0.0, < 9.0.9
8.8.12
8.9.10
9.0.9
pear/archive_tar
< 1.4.11
1.4.11
pear/archive_tar
< 1.4.11
1.4.11

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → 9.0.9

composer
composer require drupal/core:^9.0.9

pear/archive_tar Packagist → 1.4.11

composer
composer require pear/archive_tar:^1.4.11

Severity breakdown

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Exploit maturity
H

Weakness

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it
  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Critical Known exploited Also affects drupal/core
CVE-2020-36193
Directory Traversal in Archive_Tar
High Known exploited Also affects pear/archive_tar
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
High Known exploited Also affects drupal/core
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
High Known exploited Also affects drupal/core
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Not rated yet Also affects drupal/core
DRUPAL-CORE-2026-015
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Not rated yet Also affects drupal/core

Credits: Luke Stewart

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor