{"id":"CVE-2020-28949","kind":"vulnerability","aliases":["CVE-2020-28949"],"related":[],"title":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other…","description":"PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.\n\nCISA required action: Apply updates per vendor instructions.","summary":"PEAR Archive_Tar is a PHP library for reading and writing tar archives, and it fails to block the uppercase PHAR:// stream wrapper while blocking lowercase phar://. An attacker who can get the application to open a crafted archive path can trigger PHP object deserialization and may run code.","severity":"high","cvss":7.8,"epss":0.84554,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"PEAR Archive_Tar","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"php archive tar","fixed":["1.4.12"],"affected":"< 1.4.12","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 32","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 33","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 34","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 35","ecosystem":"vendor"},{"name":"drupal","fixed":["7.75"],"affected":">= 7.0, < 7.75","ecosystem":"vendor"},{"name":"drupal","fixed":["8.9.10"],"affected":">= 8.0.0, < 8.9.10","ecosystem":"vendor"},{"name":"drupal","fixed":["8.8.12"],"affected":">= 8.8.0, < 8.8.12","ecosystem":"vendor"},{"name":"drupal","fixed":["9.0.9"],"affected":">= 9.0.0, < 9.0.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["archive_tar","drupal","exploited","package","php","self-hosted"],"not_affected_if":["does-not-use-archive_tar","no-untrusted-archive-input"],"how_to_check":null,"fix":"Apply the vendor update per PEAR Archive_Tar instructions; fixed version not stated in the sources.\nUpgrade archive_tar to the patched release from Packagist or PEAR; exact version unknown.","status":"open","published_at":"2020-11-19T19:15:11+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:55+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:10:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per PEAR Archive_Tar instructions; fixed version not stated in the sources.\nUpgrade archive_tar to the patched release from Packagist or PEAR; exact version unknown.","reach":"unknown","impact":"high","summary":"PEAR Archive_Tar is a PHP library for reading and writing tar archives, and it fails to block the uppercase PHAR:// stream wrapper while blocking lowercase phar://. An attacker who can get the application to open a crafted archive path can trigger PHP object deserialization and may run code.","category":"package","who_cares":["php","archive_tar","drupal","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker may trigger PHP object deserialization, possibly leading to code execution","analyst_note":"Find the fixed Archive_Tar version and the PHP-side check (composer show or pear list) from the vendor advisory and NVD; the sources do not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-archive-input","does-not-use-archive_tar"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":2900,"output_tokens":432,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':16A,19A '-28949':17A,20A '1.4.10':4A 'action':156C 'address':10A 'allow':102C 'appli':157C 'applic':83B,121C 'archiv':1A,43B,53B,64B,88B,100C 'archive':22A,25A 'attack':12A,78B,105C 'block':69B,75B,109C,114C 'cisa':154C 'code':98B 'compon':137C 'core':149C 'craft':87B 'cve':15A,18A 'debian':27A,29A 'deseri':94B 'distribut':132C 'drupal':39A,40A,41A,42A,45B,148C 'exploit':46B 'extens':119C 'fail':67B 'fedora':32A,34A,36A,38A 'fedoraproject':31A,33A,35A,37A 'filenam':6A 'framework':130C 'get':81B 'hat':152C 'host':51B 'instruct':161C 'known':139C 'librari':58B 'linux':28A,30A,153C 'lowercas':76B 'may':96B 'object':93B 'open':85B,128C 'open-sourc':127C 'packag':47B 'parti':144C 'path':89B 'pear':21A,52B,99C,115C 'per':159C 'phar':11A,107C,111C 'php':24A,48B,57B,92B,118C,136C 'product':145C 'read':60B 'red':151C 'repositori':122C 'requir':155C 'reusabl':135C 'run':97B 'sanit':7A 'self':50B 'self-host':49B 'sourc':129C 'stand':116C 'stream':72B 'system':133C 'tar':2A,23A,26A,44B,54B,63B,101C 'third':143C 'third-parti':142C 'thus':14A 'trigger':91B 'unseri':104C 'updat':158C 'uppercas':71B 'usag':140C 'vendor':160C 'wrapper':73B 'write':62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-11-19T19:15:11+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-28949","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-28949","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:42+00:00","note":null},{"source":"epss","external_id":"CVE-2020-28949","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28949","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-28949","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28949","severity":null,"published_at":"2020-11-19T19:15:11+00:00","modified_at":"2026-06-17T03:10:53+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}