CVE-2020-36193

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22CWE-59

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 18, 2021
Last modified
Jun 17, 2026
Added to CISA KEV
Aug 25, 2022
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-361946.1An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inCVE-2020-361959.8An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, CVE-2020-361966.1A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to iCVE-2020-361978.8An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allCVE-2020-361986.7A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows rCVE-2020-361999.8TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several pCVE-2020-36205.5u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to CVE-2020-362006.5TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.CVE-2020-362017.5An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi CVE-2020-362026.1An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.CVE-2020-362034.7An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race anCVE-2020-362044.7An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait,
CVE-2020-36193: High severity, CVSS 7.5 | Vulnix