DRUPAL-CORE-2020-013 in drupal/core
Published 25 Nov 2020 · Updated 19 Sept 2026
Affected package
- Affected
- >=8.0.0 <8.8.12 · >=8.9.0 <8.9.10 · >=9.0.0 <9.0.9
- Fixed in
- 8.8.12, 8.9.10, 9.0.9
composer require drupal/core:^9.0.9Details
The Drupal project uses the PEAR Archive\_Tar library. The PEAR Archive\_Tar library has released a security update that impacts Drupal. For more information please see:
Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.
To mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.
This is a different issue than SA-CORE-2019-012. Similar configuration changes may mitigate the problem until you are able to patch.
Is DRUPAL-CORE-2020-013 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.