CVE-2020-7061

PoC —

CVSS 3.1

9.1 critical

EPSS

4%p90

Published

Feb 27, 2020 (Feb 27, 2020)

Modified

Jun 17, 2026

Description

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Vendors: php tenable
Products: php, tenable.sc
Weakness: CWE-125
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news0 stories

No ingested article mentions this CVE yet.