CVE-2020-28948

Name of the Vulnerable Software and Affected Versions Archive Tar versions 1.4.10 and earlier

Description The issue allows an unserialization attack because phar: is blocked but PHAR: is not blocked. This can be exploited by a remote attacker to execute arbitrary PHP code using a specially crafted .tar archive. The vulnerability is related to the restoration of an untrusted data structure in memory.

Recommendations For Archive Tar versions 1.4.10 and earlier, consider disabling the use of PHAR: until a patch is available. As a temporary workaround, restrict the use of the Archive Tar class to minimize the risk of exploitation. Avoid using specially crafted .tar archives that could trigger the unserialization attack.