CVE-2021-32610
HighDirectory Traversal in Archive_Tar
Published Aug 9, 2021 · Updated Sep 19, 2026 · Also known as DEBIAN-CVE-2021-32610, DLA-2721-1, DRUPAL-CORE-2021-004, GHSA-p8q8-jfcv-g2h2, SUSE-SU-2022:3198-1, UBUNTU-CVE-2021-32610, USN-5027-1, USN-5027-2
Key Facts
Patch immediately- CVE-2021-32610 is a high-severity vulnerability (CVSS 7.1 v3.1) affecting Archive Tar (PHP), Debian Linux, Fedora (Fedoraproject) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 73% probability of exploitation in the next 30 days.
- Fixed versions are available, including apcu-panel 5.1.18-1.module+el8.3.0+7685+72d70b58, drupal/core 8.9.17, drupal/core 9.1.11.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS (30-day exploit likelihood)
73%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-32610 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Affected Products
97 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Archive TarPHP | See advisory | 1.4.14 |
| Debian LinuxDebian | 9.0 | n/a |
| FedoraFedoraproject | 33, 34, 35 | n/a |
| nextcloudarch | See advisory | 22.2.0-1 |
| drupal7alpine | See advisory | 7.82-r0 |
Patched Releases
apcu-panel
5.1.18-1.module+el8.3.0+7685+72d70b58
drupal/core
8.9.17, 9.1.11, 9.2.2
drupal7
7.52-2+deb9u16, 7.82-r0
libzip
1.6.1-1.module_el8.6.0+2750+78feabcb, 1.6.1-1.module+el8.3.0+7685+72d70b58, 1.6.1-1.module+el8.6.0+789+2130c178
libzip-devel
1.6.1-1.module+el8.3.0+7685+72d70b58
libzip-tools
1.6.1-1.module+el8.3.0+7685+72d70b58
nextcloud
22.2.0-1
pear/archive_tar
1.4.14
php
7.4.30-1.module_el8.7.0+3286+227f3cf0, 7.4.30-1.module+el8.7.0+1067+0a7071cc, 7.4.30-1.module+el8.7.0+20800+8e29b882
Archive Tar
1.4.14
php-bcmath
7.4.30-1.module+el8.7.0+20800+8e29b882
php-cli
7.4.30-1.module+el8.7.0+20800+8e29b882
php-common
7.4.30-1.module+el8.7.0+20800+8e29b882
php-dba
7.4.30-1.module+el8.7.0+20800+8e29b882
php-dbg
7.4.30-1.module+el8.7.0+20800+8e29b882
php-devel
7.4.30-1.module+el8.7.0+20800+8e29b882
php-embedded
7.4.30-1.module+el8.7.0+20800+8e29b882
php-enchant
7.4.30-1.module+el8.7.0+20800+8e29b882
php-ffi
7.4.30-1.module+el8.7.0+20800+8e29b882
php-fpm
7.4.30-1.module+el8.7.0+20800+8e29b882
php-gd
7.4.30-1.module+el8.7.0+20800+8e29b882
php-gmp
7.4.30-1.module+el8.7.0+20800+8e29b882
php-intl
7.4.30-1.module+el8.7.0+20800+8e29b882
php-json
7.4.30-1.module+el8.7.0+20800+8e29b882
php-ldap
7.4.30-1.module+el8.7.0+20800+8e29b882
Timeline
Publicly disclosed
Aug 9, 2021
Last updated
Sep 19, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
References
- advisoryRHSA-2022:7628
- advisoryGHSA advisory
- advisoryhttps://github.com/pear/Archive_Tar/releases/tag/1.4.14
- advisory[debian-lts-announce] 20210726 [SECURITY] [DLA 2721-1] drupal7 security update
- advisoryhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
FAQ
Common Questions.
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Affected: Archive Tar (PHP); Debian Linux versions 9.0; Fedora (Fedoraproject) versions 33, 34, 35, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apcu-panel 5.1.18-1.module+el8.3.0+7685+72d70b58, drupal/core 8.9.17, drupal/core 9.1.11.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-32610 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo