CVE-2020-28948

PoC —

CVSS 3.1

7.8 high

EPSS

47%p99

Published

Nov 19, 2020 (Nov 19, 2020)

Modified

Jun 17, 2026

Description

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Vendors: php debian fedoraproject drupal
Products: archive tar, debian linux, fedora, drupal
Weakness: CWE-502
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (47.5%)

In the news3 stories

Drupal emergency updates fix critical arbitrary PHP code execution

Security AffairsNov 27, 22:55 UTC · Nov 27, 2020Vulnerability CVE-2020-28948 CVE-2020-28949 CVE-2020-13671

60

Out-of-band Drupal security updates fix bugs with known exploits

Help Net SecurityNov 27, 00:00 UTC · Nov 27, 2020Vulnerability CVE-2020-28948 CVE-2020-28949 CVE-2020-13671

60

Drupal fixed a new flaw related PEAR Archive_Tar library

Security AffairsJan 22, 08:25 UTC · Jan 22, 2021Vulnerability CVE-2020-36193 CVE-2020-28948

35