#VU55101 Link following in Archive_Tar - CVE-2021-32610
Published: July 20, 2021 / Updated: July 22, 2021
Vulnerability identifier: #VU55101
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2021-32610
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Archive_Tar
Archive_Tar
Software vendor:
PHP Group
PHP Group
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to the application does not check if the file in the archive is a symbolic link when extracting it. A remote attacker can pass a specially crafted file to the application and overwrite arbitrary files on the system. Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Remediation
Install updates from vendor's website.