CVE-2020-7068

PoC —

CVSS 3.1

3.6 low

EPSS

2%p75

Published

Sep 9, 2020 (Sep 9, 2020)

Modified

Jun 17, 2026

Description

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

Vendors: php debian tenable
Products: php, debian linux, tenable.sc
Weakness: CWE-416
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.