{"action":"Upgrade drupal/core to 8.8.12 or later.","affected":[{"fixed":"8.8.12","introduced":"8.0.0"},{"fixed":"8.9.10","introduced":"8.9.0"},{"fixed":"9.0.9","introduced":"9.0.0"}],"component":"drupal/core","cve_ids":["CVE-2020-28948","CVE-2020-28949"],"ecosystem":"Packagist","epss":0.47493,"exploited":false,"fixed_versions":["8.8.12","8.9.10","9.0.9"],"ghsa_id":"GHSA-75c5-f4gw-38r9","id":"tcs_01M5KER8T57Z0TA6D3KQ24QCMY","modified_at":"2026-09-19T17:39:28Z","published_at":"2020-11-25T23:57:48Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2020-013","https://www.drupal.org/sa-core-2020-013"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2020-013","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2020-013"}],"summary":"The Drupal project uses the PEAR Archive\\_Tar library. The PEAR Archive\\_Tar library has released a security update that impacts Drupal. For more information please see:"}