{"id":"GHSA-p8q8-jfcv-g2h2","aliases":["CVE-2021-32610","DRUPAL-CORE-2021-004"],"title":"DRUPAL-CORE-2021-004","description":"The Drupal project uses the pear Archive\\_Tar library, which has released a security update that impacts Drupal.\n\nThe vulnerability is mitigated by the fact that Drupal core's use of the Archive\\_Tar library is not vulnerable, as it does not permit symlinks.\n\nExploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source.\n\nThis advisory is not covered by [Drupal Steward](/steward).","severity":"high","score":7.1,"published":"2021-07-21T15:59:27.000Z","modified":"2026-09-19T17:45:13.000Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pear/archive_tar","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.4.14"}],"type":"ECOSYSTEM"}],"versions":["1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"fixed":["1.4.14"]},{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"8.0.0"},{"fixed":"8.9.17"}],"type":"ECOSYSTEM","database_specific":{"constraint":">= 8.0.0 <8.9.17"}},{"events":[{"introduced":"9.1.0"},{"fixed":"9.1.11"}],"type":"ECOSYSTEM","database_specific":{"constraint":">= 9.1.0 <9.1.11"}},{"events":[{"introduced":"9.2.0"},{"fixed":"9.2.2"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=9.2.0 <9.2.2"}}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.14","8.9.15","8.9.16","8.9.2","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.1.0","9.1.1","9.1.10","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.1"],"fixed":["8.9.17","9.1.11","9.2.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-32610","https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755","https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f","https://github.com/pear/Archive_Tar","https://github.com/pear/Archive_Tar/releases/tag/1.4.14","https://lists.debian.org/debian-lts-announce/2021/07/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5LTY6COQYNMMHQJ3QIOJHEWCKD4XDFH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","https://www.drupal.org/sa-core-2021-004"],"sources":[{"name":"OSV","id":"GHSA-p8q8-jfcv-g2h2","modified":"2025-12-10T23:40:57.950081Z","url":"https://osv.dev/vulnerability/GHSA-p8q8-jfcv-g2h2"},{"name":"OSV","id":"DRUPAL-CORE-2021-004","modified":"2026-09-19T17:45:13Z","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2021-004"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":7.1}],"evidence":[]}