typo3 pharstreamwrapper vulnerabilities

Latest typo3 pharstreamwrapper CVEs

Newest publication first

1. CVE-2019-11831 Directory Traversal in typo3/phar-stream-wrapper

   Published 2019-05-09

   Critical·CVSS 9.8 EPSS 5.4% PoC

   The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

2. CVE-2019-11830 PharStreamWrapper for Typo3 unsafe deserialization vulnerability

   Published 2019-05-09

   Critical·CVSS 9.8 EPSS 2.7% PoC

   PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.