onyx

onyx --cves cve-2020-36193

CVE-2020-36193

HIGHKEVDrupal, PHP
score
<0.1
cvss
7.5
epss
70.6%
published
2021-01-18
kev added
2022-08-25
first seen

Archive_Tar through 1.4.11 contains a directory traversal caused by inadequate checking of symbolic links in tar.php, letting attackers write arbitrary files, exploit requires attacker to control tar archive contents.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-01-18 — PublishedP2022-08-25 — Added to CISA KEVK2026-10-21 — Tracked by OnyxTscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 70.6%2026-09-23: epss 70.6%2026-09-24: epss 70.6%2026-09-25: epss 70.6%2026-09-26: epss 70.6%2026-09-27: epss 70.6%2026-09-28: epss 70.6%2026-09-29: epss 70.6%2026-09-30: epss 70.6%2026-10-01: epss 70.6%2026-10-02: epss 70.6%2026-10-03: epss 70.6%2026-10-04: epss 70.6%2026-10-05: epss 70.6%2026-10-06: epss 70.6%2026-10-07: epss 70.6%2026-10-08: epss 70.6%2026-10-09: epss 70.6%2026-10-10: epss 70.6%2026-10-11: epss 70.6%2026-10-12: epss 70.6%2026-10-13: epss 70.6%2026-10-14: epss 70.6%2026-10-15: epss 70.6%2026-10-16: epss 70.6%2026-10-18: epss 70.6%2026-10-19: epss 70.6%2026-10-20: epss 70.6%2026-10-21: epss 70.6%70.6%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx

Weaknesses

CWE-22 CWE-59

References 9