CVE-2020-28949

PEAR's Archive_Tar library through version 1.4.10 sanitizes archive filenames only against phar:// stream-wrapper attacks, leaving all other PHP stream wrappers open to abuse; an attacker who controls an archive's filename can, for example, use the file:// wrapper to write files outside the intended directory. The flaw is triggered whenever a vulnerable application creates or extracts an archive using an attacker-influenced filename, as in Drupal core, which shipped emergency out-of-band updates because the file-write primitive allowed arbitrary PHP code execution. An attacker gains arbitrary file overwrite, and in web application contexts such as Drupal this can escalate to remote code execution by writing executable PHP into the web root. Any PHP application using the library is affected, including Drupal core and the Archive_Tar packages shipped by Debian and Fedora. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-08-25), carries a very high 84.6% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available.

What to do: Upgrade Archive_Tar to a version after 1.4.10 (1.4.11 fixes this flaw) and apply the emergency Drupal core security updates or the corresponding Debian/Fedora package updates per vendor instructions. Audit any application that passes attacker-controlled filenames or paths to Archive_Tar and consider rejecting or strictly validating filenames containing stream wrappers (e.g., '://'). Because this flaw is in CISA's Known Exploited Vulnerabilities Catalog, patch promptly to meet the catalog's required action deadlines.