CVE-2021-32610 EPSS 73.4%

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

Summary

The flaw affects Archive_Tar, a PHP library for handling tar archives, in versions before 1.4.14, where symlinks inside an archive can point to targets outside the directory the archive is extracted into.

Heading is the official description · CVE.org

Breakdown

19.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 27 Jul 2021. No public exploit code or confirmed exploitation is recorded.

See the family tree

5 related vulnerabilities in the same code over 3 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502…27 Dec 2018
relatedHigh
Why these are linked:
- Fixed one release later1.4.4 → 1.4.11 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)Functions: _tarRecToSizecommit 59ace12 commit 0670a05
CVE-2020-28948Archive_Tar through 1.4.10 allows an unserialization attack…19 Nov 2020
same family
CVE-2020-28949PEAR Archive_Tar Deserialization of Untrusted Data19 Nov 2020KEV
Next fix in the same packageHigh
Why these are linked:
- Fixed one release later1.4.11 → 1.4.13 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)commit 0670a05 commit cde4605
CVE-2020-36193PEAR Archive_Tar Improper Link Resolution18 Jan 2021KEV
relatedHigh
Why these are linked:
- Fixed one release later1.4.13 → 1.4.14 (pear/archive_tar)
- Same code patched: Tar.php (machine-matched)Functions: _extractListcommit cde4605 commit b583243 commit 7789ebb
This CVECVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets…27 Jul 2021

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: pear/archive_tar.

Packagistpear/archive_tarGHSA-p8q8-jfcv-g2h2

Upgrade to 1.4.14 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-28949, CVE-2020-36193).

Set the version to 1.4.14 or later in your composer.json.

The first fix for CVE-2021-32610.

Affected versions

If you run	Upgrade to
All versions before 1.4.14	1.4.14

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Packagistdrupal/core
Affected: 9.2.0 up to 9.2.2; 9.1.0 up to 9.1.11; 8.0.0 up to 8.9.17Upgrade to 9.2.2 or later (older lines: 9.1.11, 8.9.17)
DRUPAL-CORE-2021-004

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

9 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-1814

No public exploit code found.

, 30 Oct 2026

73.4%Top 0.54%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.46%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9946 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total19.9

Record

Published: 27 Jul 2021
Modified: 3 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_CONFIRM 1

mailing-list 1

x_refsource_MISC 3

vendor-advisory 4

techniques