CVE-2021-32610
moderate-risk
Published 2021-07-30
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Do I need to act?
~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.1/10
High
LOCAL
/ LOW complexity
Affected Products (5)
Affected Vendors
References (18)
Release Notes
https://github.com/pear/Archive_Tar/releases/tag/1.4.14
Third Party Advisory
https://www.drupal.org/sa-core-2021-004
Release Notes
https://github.com/pear/Archive_Tar/releases/tag/1.4.14
Third Party Advisory
https://www.drupal.org/sa-core-2021-004
40
/ 100
moderate-risk
Severity
22/34 · High
Exploitability
6/34 · Minimal
Exposure
12/34 · Low