-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The _maliciousFilename method lacked a check for 'phar://' prefixes (added in the patch), allowing attackers to bypass path validation. 2) The _extractFile method (and related extraction logic) used $v_header['filename'] in PHP filesystem functions (file_exists/is_dir/etc.) without proper sanitization. When combined, these allow phar:// wrappers to trigger deserialization via Phar metadata. The exploit examples and patch focus on these components, confirming their critical role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pear/archive_tar | composer | < 1.4.4 | 1.4.4 |