DRUPAL-CORE-2021-001

At a glance

Published: 2021-01-20 17:10 UTC
Updated: 2026-09-19 17:42 UTC

Description

The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For more information please see: * [CVE-2020-36193](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36193) Exploits may be possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2`, or `.tlz` file uploads and processes them.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 8.9.13 ; introduced 9.0.0, fixed 9.0.11 ; introduced 9.1.0, fixed 9.1.3

References

https://www.drupal.org/sa-core-2021-001 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence