CVE-2020-28949
Known Exploited (CISA KEV)HIGH
7.8
CVSS Severity Score
Vulnerability Description
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Affected Platforms (CPE)
📦
Php
Archive Tar
< 1.4.12💻
Debian
Debian Linux
= 9.0💻
Debian
Debian Linux
= 10.0💻
Fedoraproject
Fedora
= 32💻
Fedoraproject
Fedora
= 33💻
Fedoraproject
Fedora
= 34💻
Fedoraproject
Fedora
= 35📦
Drupal
Drupal
>= 7.0 and < 7.75📦
Drupal
Drupal
>= 8.0.0 and < 8.9.10📦
Drupal
Drupal
>= 8.8.0 and < 8.8.12📦
Drupal