Vulnerability record · CVE-2020-28949 · published 19 November 2020
CVE-2020-28949: PEAR Archive_Tar stream-wrapper filename sanitization bypass allows file write
Php · Archive Tar
Archive_Tar through 1.4.10 only sanitizes '://' filenames to block phar attacks, so other stream wrappers such as file:// still pass through and can overwrite files during archive extraction. Because Archive_Tar is bundled with PHP and used by projects like Drupal, the flaw affects a wide install base and enables arbitrary file write on the extracting host.
Description
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is in CISA KEV with public exploit code and a very high EPSS score, but exploitation requires the victim to process a malicious archive, which limits mass remote exploitation.
What it is
Archive_Tar through 1.4.10 only sanitizes '://' filenames to block phar attacks, so other stream wrappers such as file:// still pass through and can overwrite files during archive extraction. Because Archive_Tar is bundled with PHP and used by projects like Drupal, the flaw affects a wide install base and enables arbitrary file write on the extracting host.
Impact
An attacker who can supply a crafted tar archive can write files to attacker-chosen paths on the target system, which can lead to code execution or configuration tampering depending on what is overwritten.
Attack surface
Reached when an application extracts an untrusted tar archive with the vulnerable library; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), and the local vector reflects that the attacker's archive must be processed by the victim.
Exploitation
CVE-2020-28949 is listed in CISA KEV with a 2022-08-25 addition date, and EPSS gives a 30-day probability of 0.84554 (99.7th percentile); references are tagged Exploit, confirming public exploit material exists.
What to do
- Upgrade Archive_Tar to a version after 1.4.10, or apply the vendor patch for your PHP, Debian, Fedora, Gentoo or Drupal distribution.
- If immediate patching is not possible, avoid extracting untrusted tar archives with Archive_Tar and validate archive member names before extraction.
- Restrict write permissions for the process that performs extraction so a successful write cannot reach sensitive paths.
- Track the Drupal SA-CORE-2020-013 and distribution advisories to confirm all bundled copies of the library are updated.
- Monitor for unexpected file creation or modification in web-accessible and configuration directories after archive processing.
Detection
- Alert on file writes or modifications to web roots, configuration files or startup paths that occur shortly after tar extraction activity.
- Search application and system logs for Archive_Tar extraction errors or warnings referencing unusual filenames or stream-wrapper prefixes.
- Inventory hosts and containers for Archive_Tar versions at or below 1.4.10, including copies bundled inside PHP and Drupal installations.
- Correlate outbound retrieval of tar archives with subsequent file system changes on the extracting host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-28949 to the Known Exploited Vulnerabilities catalog on 25 August 2022 as "PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 September 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-28949 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-28949), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
