Directory Traversal in Archive_Tar
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
There was an initial fix for this vulnerability made in version 1.4.12. That fix introduced a bug which was fixed in 1.4.13. Therefore we have set the first-patched-version to 1.4.13 which the earliest working version that avoids this vulnerability.
Why this VPI (explainable, experimental)
VPI breakdown
| Impact | 75.00 |
| Exploitation signal(KEV listed) | ×1.50 |
| VPI | 100.00 |
VPI formula vpi-v1
Required Action
Apply updates per vendor instructions.