DRUPAL-CORE-2021-001 The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal.
Attackers can exploit a path traversal vulnerability in the Archive_Tar library to read or modify files if Drupal is configured to process specific archive uploads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CORE-2021-001?
DRUPAL-CORE-2021-001 is a path traversal vulnerability in drupal/core, published on 20 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal. For more information please see:
Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.
Which versions are affected by DRUPAL-CORE-2021-001?
1 open source package ship an affected version, including drupal/core.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 8.0.0 | 8.9.13, 9.0.11, 9.1.3 |
How do I fix DRUPAL-CORE-2021-001?
Upgrade drupal/core to a fixed version for your release line: 8.9.13, 9.0.11 or 9.1.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is DRUPAL-CORE-2021-001 being exploited?
There is no known exploitation of DRUPAL-CORE-2021-001 in the wild and no public exploit code.