CVE-2020-28949
🔥 Known Exploited (CISA KEV)HIGH
7.8
CVSS Severity Score
Vulnerability Description
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Affected Platforms (CPE)
📦
Php
Archive Tar
< 1.4.12
💻
Debian
Debian Linux
= 9.0= 10.0
💻
Fedoraproject
Fedora
= 32= 33= 34= 35
📦
Drupal
Drupal
>= 7.0 and < 7.75>= 8.0.0 and < 8.9.10>= 8.8.0 and < 8.8.12>= 9.0.0 and < 9.0.9