CVE-2020-36193 is an improper link resolution vulnerability in PEAR Archive_Tar. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 August 2022, which means attackers have used it in real attacks. PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links.
What this vulnerability means in practice
Improper link resolution in an archive extraction component means a seemingly normal unpack operation can be turned into a write primitive outside the intended directory tree. In this case, the danger comes from symbolic links being handled too loosely during Tar.php write operations, which can let archive contents escape the extraction boundary.
That matters because archive handling is often treated as routine utility code, not as a security boundary. When extraction logic follows links incorrectly, the file system can be altered in places the application did not intend to touch, including configuration, code, or other writable targets that should have remained protected.
Why archive link traversal is dangerous
Archive-based traversal flaws are especially serious when the application processes attacker-controlled uploads or downloads. The archive may look harmless, but the extraction step can redirect writes to unexpected paths if link checks are incomplete. That turns a file format issue into a broader integrity problem.
For this CVE, the core security concern is not only that files can be written, but that the write may land outside the expected directory. Readers should treat that as a boundary-breaking condition, because it can defeat the assumptions behind sandboxing, packaging workflows, and automated content processing.
For authoritative record details, use the CVE Program entry and the NIST National Vulnerability Database record rather than relying on secondary summaries for scope or status.
How organisations assess exposure and reduce risk
Exposure review starts with inventorying every place PEAR Archive_Tar is present, then checking whether any path accepts untrusted archives or performs server-side extraction. Internet-facing upload flows, automation jobs, and CI or deployment utilities deserve particular attention because they can turn a single archive into a high-impact write event.
Where patching is delayed, the practical goal is to narrow the trust boundary around archive handling. Limit who can supply archives, isolate the extraction environment, and avoid privileged execution paths for routines that unpack external content. If possible, replace vulnerable workflows with safer processing that does not rely on link-following behaviour during extraction.
Because this is a known exploited weakness, prioritisation should align with active exposure rather than just software presence. Use the NIST National Vulnerability Database together with vendor advisories and your own asset inventory to confirm where the component is reachable and how it is used.
Detection and compromise review after patching
After remediation, organisations should review whether the flaw was already used to place or overwrite unexpected files. The most useful checks focus on file-system changes that should not have occurred during archive processing, especially new or altered files outside the intended extraction root.
Post-patch review also needs to cover adjacent trust failures, because an archive write primitive can be a staging step rather than the end goal. If attackers used it to alter application behaviour, investigate configuration drift, unexpected executables, modified scripts, and any integrity-sensitive paths associated with the affected service.
When a package or deployment system has processed suspicious archives, the review should extend to any credentials, keys, or session material that may have been exposed by file replacement or configuration tampering. That impact is situational, but it becomes material when the write lands in locations that influence authentication, secrets handling, or code loading.
Risk and Threat Considerations
This vulnerability creates a concrete integrity risk because archive extraction can become a path to arbitrary file writes outside the intended directory. In exposed applications, that can support defacement, service disruption, configuration tampering, or persistence through overwritten content.
Failure mechanism: Inadequate symbolic-link validation allows archive entries to resolve to unexpected filesystem locations during write operations, defeating the extraction boundary.
Impact: Attackers may overwrite sensitive files, plant malicious content, alter application behaviour, or use the write primitive as a foothold for broader compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires inventory, prioritisation, and remediation of exploitable software weaknesses. |
| Recommendation — Track Archive_Tar exposure, prioritise remediation, and verify closure with repeatable vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The flaw is an exploitable software vulnerability that calls for timely remediation and validation. |
| CM-7 — Least Functionality | Reducing unnecessary archive-processing capability limits the blast radius of unsafe extraction paths. | |
| AC-6 — Least Privilege | Untrusted archive extraction should not run with permissions that allow broad filesystem writes. | |
| Recommendation — Patch or mitigate the vulnerable component and confirm remediation is effective. Disable or restrict archive handling paths that are not essential to the system. Run extraction with the minimum permissions needed to prevent unauthorized writes. | ||
| OWASP ASVS | V5 — File Handling | The vulnerability is a file-processing weakness involving unsafe archive extraction and path handling. |
| Recommendation — Verify that uploaded or processed archives cannot escape the intended extraction directory. | ||
Practitioner Guidance
Why practitioners should care: Treat archive extraction as a security-sensitive operation when the archive source is outside your control. The practical question is not whether the component can unpack files, but whether it can do so without following links into protected or unintended paths.
What to watch for: Prioritise environments where uploads, package imports, or automated extract jobs accept attacker-influenced archives. Those paths are the ones most likely to turn a link-resolution bug into a real-world integrity event.
Practitioner takeaway: If you cannot patch immediately, reduce exposure by constraining who can trigger extraction, isolating the process, and validating that archive handling cannot write beyond the approved directory tree.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org