php archive tar vulnerabilities

Latest php archive tar CVEs

Newest publication first

1. CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

   Published 2024-04-29

   Medium·CVSS 6.5 EPSS 38.1%

   Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

2. CVE-2021-32610 Directory Traversal in Archive_Tar

   Published 2021-07-27

   High·CVSS 7.1 EPSS 73.4%

   In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

3. CVE-2020-36193 Directory Traversal in Archive_Tar

   Published 2021-01-18

   High·CVSS 7.5 EPSS 70.6% CISA KEV added 2022-08-25 Exploited in the wild PoC

   Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

4. CVE-2020-28948 Deserialization of Untrusted Data in Archive_Tar

   Published 2020-11-19

   High·CVSS 7.8 EPSS 47.5%

   Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

5. CVE-2020-28949 Multiple vulnerabilities through filename manipulation in Archive_Tar

   Published 2020-11-19

   High·CVSS 7.8 EPSS 84.6% CISA KEV added 2022-08-25 Exploited in the wild Framework module Public exploit PoC

   Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.