CyberSec.Space Logo
Back to CVE Browser

CVE-2020-28949

🔥 Known Exploited (CISA KEV)HIGH
7.8
CVSS Severity Score
EPSS Score42.5700%
EPSS Percentile98.81th
Published2020-11-19
Last Modified2025-11-07
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Affected Platforms (CPE)

📦
Php

Archive Tar

< 1.4.12
💻
Debian

Debian Linux

= 9.0= 10.0
💻
Fedoraproject

Fedora

= 32= 33= 34= 35
📦
Drupal

Drupal

>= 7.0 and < 7.75>= 8.0.0 and < 8.9.10>= 8.8.0 and < 8.8.12>= 9.0.0 and < 9.0.9

References & Advisories

🔗 http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html
🔗 https://github.com/pear/Archive_Tar/issues/33
🔗 https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 30, 2026

Today’s threat intelligence covers Ruby on Rails CVE-2026-66066 arbitrary file read, Gitea CVE-2026-60004 Git hook command execution, coordinated attacks on Minnesota water systems, Ruflo MCP Bridge RCE, and Firefox CVE-2026-10702.

2026-07-30

Daily Global Cyber Threat Intelligence Digest — July 29, 2026

Today’s threat intelligence covers active exploitation of Arista VeloCloud CVE-2026-16812, unauthenticated TeamCity RCE CVE-2026-63077, exposed IPMI/BMC password risks, and the Origin Energy and MCBS breach updates.

2026-07-29

Daily Global Cyber Threat Intelligence Digest — July 28, 2026

Today’s threat intelligence covers the Certighost CVE-2026-54121 AD CS domain-takeover chain, vBulletin CVE-2026-61511 pre-auth RCE, the expanding Dysphoria botnet, and the DentaQuest and Fairlife breach updates.

2026-07-28

Related Vulnerabilities

CVE-2026-419399.3

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management inte...

CVE-2026-137236.5

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on...

CVE-2026-547278.2

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries wh...

CVE-2026-545748.2

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root...