Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
Priority LOW 38Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
The Drupal project uses the third-party library [Archive_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities.
Why it matters now
Fix Fixed drupal/core (Packagist): 7.69, 8.7.11, 8.8.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | drupal/core (Packagist) | 7.0.0 to before 7.69 | 7.69 | Patch available | GHSA-98h9-727m-44qv |
| — | drupal/core (Packagist) | 8.0.0 to before 8.7.11 | 8.7.11 | Patch available | GHSA-98h9-727m-44qv |
| — | drupal/core (Packagist) | 8.8.0 to before 8.8.1 | 8.8.1 | Patch available | GHSA-98h9-727m-44qv |
- drupal/core (Packagist) Vendor— Affected 7.0.0 to before 7.69 Fixed in 7.69 Patch available GHSA-98h9-727m-44qv
- drupal/core (Packagist) Vendor— Affected 8.0.0 to before 8.7.11 Fixed in 8.7.11 Patch available GHSA-98h9-727m-44qv
- drupal/core (Packagist) Vendor— Affected 8.8.0 to before 8.8.1 Fixed in 8.8.1 Patch available GHSA-98h9-727m-44qv
Remediation
- Fix · GHSA-98h9-727m-44qv drupal/core (Packagist) Fixed in 7.69 Advisory →
- Fix · GHSA-98h9-727m-44qv drupal/core (Packagist) Fixed in 8.7.11 Advisory →
- Fix · GHSA-98h9-727m-44qv drupal/core (Packagist) Fixed in 8.8.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-98h9-727m-44qv
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences