Directory Traversal

2021-01-1901:26:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.924 High

EPSS

Percentile

99.0%

JSON

archive_tar is vulnerable to directory traversal. The vulnerability exists due to the lack of sanitization of symbolic links to out-of-path filenames, allowing an attacker to inject ../ characters in a file or folder name to perform symlink attacks.

CPENameOperatorVersion
pear/archive_tarle1.4.11
drupal7:3.12eq7.70-r0
drupal7:stretcheq7.52-2+deb9u11
php-pear:sideq1:1.10.9+submodules+notgz-1
php-pear:stretcheq1:1.10.1+submodules+notgz-9+deb9u1
php-pear:bustereq1:1.10.6+submodules+notgz-1.1+deb10u1
drupal7:edgeeq7.69-r1
drupal7:edgeeq7.70-r0
pear/archive_tarle1.4.11
drupal7:3.12eq7.70-r0

Name	Operator	Version
pear/archive_tar	le	1.4.11
drupal7:3.12	eq	7.70-r0
drupal7:stretch	eq	7.52-2+deb9u11
php-pear:sid	eq	1:1.10.9+submodules+notgz-1
php-pear:stretch	eq	1:1.10.1+submodules+notgz-9+deb9u1
php-pear:buster	eq	1:1.10.6+submodules+notgz-1.1+deb10u1
drupal7:edge	eq	7.69-r1
drupal7:edge	eq	7.70-r0
pear/archive_tar	le	1.4.11
drupal7:3.12	eq	7.70-r0