High 1 exploited CVE DLA-2466-1 2 CVEs

drupal7 - security update

Published Nov 26, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	drupal7	7.52-2+deb9u13

Vulnerabilities 2

High 7.8

CVE-2020-28949 Exploited Public exploit EPSS 85%

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine

Nov 19, 2020
KEV Aug 25, 2022
High 7.8

CVE-2020-28948 Public exploit EPSS 47%

Multiple vulnerabilities through filename manipulation in Archive_Tar

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist

Nov 19, 2020