PEAR Archive_Tar Stream Wrapper Bypass Arbitrary File Write and Remote Code Execution (CVE-2020-28949)
Executive & SecOps Summary
SECOPS ASSESSMENTPHP applications and CMS frameworks (such as Drupal) utilizing PEAR Archive_Tar versions 1.4.10 and below
Remote attackers can bypass filename sanitization to write or overwrite arbitrary files on the system, potentially leading to Remote Code Execution (RCE)
Immediately upgrade the PEAR Archive_Tar package to version 1.4.11 or higher
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the Archive_Tar package to version 1.4.11 or later using PEAR or Composer.
# If using PEAR package manager
pear upgrade Archive_Tar
# If managing dependencies via Composer
composer update pear/archive_tar --with-dependencies2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, restrict execution permissions in upload directories and validate file extensions before extraction.
# Nginx configuration to disable PHP execution in upload directories
location /uploads/ {
location ~ \.(php|phtml|php3|php4|php5|phps)$ {
deny all;
return 403;
}
}3. Log Audit & IoC Verification Commands
Verify the installed package version and scan system logs for potential exploitation attempts using stream wrappers.
# 1. Check the installed version of Archive_Tar
composer show pear/archive_tar | grep -i version
# 2. Scan web server logs for stream wrapper patterns in requests
grep -riE '(file|phar|gopher|http|ftp)://' /var/log/nginx/ /var/log/apache2/Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Archive_Tar component of PHP PEAR due to insufficient input validation of filenames within tar archives. A previous fix (CVE-2020-28948) only blocked the phar:// stream wrapper to prevent deserialization attacks. However, it failed to account for other PHP stream wrappers. An attacker can exploit this by using alternative wrappers, such as file://, to bypass the sanitization logic and write files to arbitrary locations on the target filesystem.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious Tar archive containing a file whose name is prefixed with a stream wrapper, such as file:///var/www/html/shell.php. When the vulnerable application extracts this archive using Archive_Tar, the library fails to sanitize the stream wrapper prefix. PHP's underlying filesystem functions resolve the stream wrapper, causing the extractor to write the payload directly to the specified absolute path instead of the intended extraction directory.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability with a high EPSS score, this flaw is actively exploited in the wild. If an application allows untrusted users to upload and extract archives, an unauthenticated attacker can easily upload a web shell and compromise the underlying server. This can lead to full system takeover, lateral movement within the cloud/enterprise network, and severe data breaches.
Official Vendor Advisories & References
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Frequently Asked SecOps Questions (CVE-2020-28949)
FAQQ1. How critical is CVE-2020-28949 and is it actively exploited in the wild?
CVE-2020-28949 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 84.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-28949?
Primary impacted vendors include pear across archive_tar. Scope summary: PEAR Archive_Tar versions up to and including 1.4.10
Q3. What temporary mitigations or workarounds exist for CVE-2020-28949 before patching?
[Mitigation] Immediately upgrade the PEAR Archive_Tar package to version 1.4.11 or higher Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-28949
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (pear)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.