{"id":"CVE-2021-32610","published":"2021-07-27T05:21:47Z","modified":"2024-08-03T23:25:30Z","title":"In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw affects Archive_Tar, a PHP library for handling tar archives, in versions before 1.4.14, where symlinks inside an archive can point to targets outside the directory the archive is extracted into.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:32Z"},"cvss":null,"epss":{"score":0.73377,"percentile":0.99461,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.drupal.org/sa-core-2021-004","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00023.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/pear/Archive_Tar/releases/tag/1.4.14","tags":["x_refsource_MISC"]},{"url":"https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5LTY6COQYNMMHQJ3QIOJHEWCKD4XDFH/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"pear/archive_tar","vulnerableRanges":["<1.4.14"],"patched":["1.4.14"],"from":["GHSA-p8q8-jfcv-g2h2"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.9.17",">=9.1.0, <9.1.11",">=9.2.0, <9.2.2"],"patched":["8.9.17","9.1.11","9.2.2"],"from":["DRUPAL-CORE-2021-004"],"provenance":"source"}],"advisories":[{"id":"GHSA-p8q8-jfcv-g2h2","url":"https://github.com/advisories/GHSA-p8q8-jfcv-g2h2","severity":"HIGH","ecosystem":"Packagist","package":"pear/archive_tar","vulnerableRanges":["<1.4.14"],"patched":["1.4.14"],"provenance":"source","from":"GHSA"},{"id":"DRUPAL-CORE-2021-004","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2021-004","severity":null,"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.9.17",">=9.1.0, <9.1.11",">=9.2.0, <9.2.2"],"patched":["8.9.17","9.1.11","9.2.2"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2021-1814","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1814","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-07-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-32610","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9946"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-pear-archive-tar-cve-2018-1000888","parents":[{"from":"CVE-2020-36193","to":"CVE-2021-32610","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pear/archive_tar","fromFixed":"1.4.13","toFixed":"1.4.14","daysApart":190},{"kind":"same-code","provenance":"machine","files":["Archive/Tar.php"],"commits":["https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916","https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f61ca26bf7d4","https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755"],"basis":"shared function","functions":["_extractList"]}]}],"packageHistory":[{"cve":"CVE-2020-28949","published":"2020-11-19","fixed":"9.0.9","kev":true},{"cve":"CVE-2020-13672","published":"2022-02-11","fixed":"9.1.7","kev":false},{"cve":"CVE-2021-33829","published":"2021-06-09","fixed":"9.1.9","kev":false,"link":{"from":"CVE-2021-33829","to":"CVE-2021-32610","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"9.1.9","toFixed":"9.1.11","daysApart":48},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.9.16","toFixed":"8.9.17","daysApart":48}]}},{"cve":"CVE-2021-32610","published":"2021-07-27","fixed":"9.2.2","kev":false},{"cve":"CVE-2020-13673","published":"2022-02-11","fixed":"9.2.6","kev":false},{"cve":"CVE-2020-13674","published":"2022-02-11","fixed":"9.2.6","kev":false},{"cve":"CVE-2020-13675","published":"2022-02-11","fixed":"9.2.6","kev":false}],"package":"Packagist:drupal/core"}}