Is CVE-2020-36193 (PEAR Archive_Tar Improper Link Resolution) being exploited in the wild?

Yes. CISA added CVE-2020-36193 to its Known Exploited Vulnerabilities catalogue on 25 August 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. Any organisation running the affected product should treat remediation as urgent.

What active exploitation means for this CVE

CISA listing a vulnerability in the Known Exploited Vulnerabilities catalog is the clearest operational signal that exploitation is not hypothetical. For this issue, that means the immediate question is not whether the flaw exists, but whether your environment still exposes the vulnerable PEAR Archive_Tar code path and whether any systems can be reached through it.

That shifts the response from routine vulnerability management to incident-aware triage. The first pass should confirm where Archive_Tar is installed, which applications invoke Tar.php, and whether the vulnerable path is reachable from untrusted input or internet-facing workflows. If the component is present but unreachable, the urgency is lower than if it is exposed in a public-facing application.

Why directory traversal and symlink handling matter

The weakness is not just a generic file handling bug. Improper link resolution can let crafted archive content escape the intended extraction directory, overwrite unexpected files, or plant content where the application never meant to write. That creates both integrity risk and, in some deployments, a route to broader compromise if the overwritten file affects code execution, configuration, or authentication logic.

For practitioners, the important distinction is between a harmless archive utility and a write primitive with attacker influence over filesystem targets. The impact depends on what the application does with extracted content, whether permissions are broad, and whether the host trusts extracted files for later execution or processing. Zero-Day and Exploited Vulnerabilities Guide is useful here because it frames the KEV-driven decision process, including emergency mitigation and post-patch verification.

When an archive parser can be steered outside its extraction boundary, the practical consequence is often file overwrite rather than immediate visible failure. That makes it easy to miss during normal testing, especially if the vulnerable path is only hit by rare upload, import, or update workflows.

What to do if patching is delayed

Where remediation cannot happen immediately, the best temporary control is to reduce exposure around every code path that accepts or extracts archives. Restrict who can upload archives, place the application behind tighter access controls, and remove any unnecessary write permissions from the account that performs extraction. If the product is internet-facing, treat it as a higher-priority exception until the fix is in place.

It also helps to assume that unsafe extraction may already have been attempted if the system was reachable before you became aware of the issue. Review web and application logs for archive uploads, unexpected file creation, path anomalies, and configuration changes that align with the vulnerable workflow. Vulnerability Management Guide supports this triage approach because KEV status should drive urgency, verification, and exception handling rather than simple ticketing.

If the affected system handles sensitive content or supports privileged workflows, rotate any credentials, session material, or deployment secrets that could have been exposed through overwritten files or tampered application state. That step is only necessary when the filesystem impact could realistically have affected authentication, configuration, or trust boundaries.

Risk and Threat Considerations

Exploitability in the wild changes the risk profile from theoretical weakness to active attack surface. For file extraction bugs, attackers commonly look for applications that unpack untrusted archives, because a single traversal mistake can become arbitrary write access in a location that changes application behavior.

Failure mechanism: The parser accepts archive members whose resolved path or link target escapes the intended directory, allowing writes to unintended locations or overwriting of files that affect execution, configuration, or trust decisions.

Impact: Depending on permissions and placement, the result can be data corruption, service disruption, application takeover, or a foothold for further compromise if a modified file is later trusted or executed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes prioritisation and remediation speed central to this CVE.
Recommendation — Prioritise and remediate KEV-listed exposure quickly using an enforced vulnerability management workflow.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE requires exposure identification, tracking, and verification before and after remediation.
	SI-2 — Flaw Remediation	The answer centers on urgent remediation for an actively exploited software flaw.
Recommendation — Scan for exposed Archive_Tar deployments and verify remediation on every affected host. Apply the vendor fix or compensating control and document exception handling until closure.
OWASP ASVS	V5 — File Handling	The vulnerability is a file extraction and path traversal issue in archive handling.
	V15 — Secure Coding and Architecture	Improper symbolic-link resolution reflects a secure design and implementation weakness.
Recommendation — Review archive extraction logic to prevent path traversal and link-following writes. Harden file-processing code so untrusted archive contents cannot alter trusted filesystem paths.

Practitioner Guidance

What to verify: Confirm whether PEAR Archive_Tar is installed, which applications invoke it, and whether any reachable workflow accepts attacker-controlled archives or archive-like content. Treat confirmed exposure as a priority even if no obvious abuse has been observed yet.

Decision rule: If the vulnerable component is reachable from a user-controlled upload, import, or update path, prioritize containment and remediation before broadening the investigation. If the component is installed but unreachable, keep it tracked, but the response can be proportional to actual exposure.

What practitioners underestimate: Archive bugs often become serious because of what they can overwrite, not because they crash the parser. The main judgment is whether the filesystem write can influence code, configuration, or credentials, because that is what turns a local parsing flaw into a security incident.

Practitioner takeaway: For KEV-listed file handling flaws, exposure mapping matters as much as patching, because reachable archive extraction paths can turn a narrow parsing bug into a broader compromise path.