—
DRUPAL-CORE-2019-012
Quick fix
DRUPAL-CORE-2019-012 — drupal/core: upgrade to the fixed version with the command below.
composer require drupal/core:^8.7.11Details
The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.
Multiple vulnerabilities are possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2` or `.tlz` file uploads and processes them.
The latest versions of Drupal update `Archive_Tar` to 1.4.9 to mitigate the file processing vulnerabilities.
*Edited to clarify the nature of the upstream release.*
Are you affected?
Enter the version of the package you're using.