CVE record
CVE-2021-32610
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
high
CVSS 7.1 · CVSS_V3
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| drupal/core | composer | 8.9.17, 9.1.11, 9.2.2 |
| pear/archive_tar | composer | 1.4.14 |