CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-11-19
PEAR Archive_Tar Stream Wrapper Bypass Arbitrary File Write and Remote Code Execution (CVE-2020-28949)
[Affected Scope] PHP applications and CMS frameworks (such as Drupal) utilizing PEAR Archive_Tar versions 1.4.10 and below
[Impact] Remote attackers can bypass filename sanitization to write or overwrite arbitrary files on the system, potentially leading to Remote Code Execution (RCE)
[Mitigation] Immediately upgrade the PEAR Archive_Tar package to version 1.4.11 or higher