High 1 exploited CVE USN-4654-1 2 CVEs

php-pear vulnerabilities

Published Dec 1, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PEAR incorrectly sanitized filenames. A remote
attacker could possibly use this issue to execute arbitrary code.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	php-pear	1:1.10.1+submodules+notgz-6ubuntu0.2
Ubuntu · 18.04 LTS 18.04:LTS	php-pear	1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
Ubuntu · 20.04 LTS 20.04:LTS	php-pear	1:1.10.9+submodules+notgz-1ubuntu0.20.04.1

Vulnerabilities 2

High 7.8

CVE-2020-28949 Exploited Public exploit EPSS 85%

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine

Nov 19, 2020
KEV Aug 25, 2022
High 7.8

CVE-2020-28948 Public exploit EPSS 47%

Multiple vulnerabilities through filename manipulation in Archive_Tar

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist

Nov 19, 2020

References

report
https://ubuntu.com/security/CVE-2020-28948
report
https://ubuntu.com/security/CVE-2020-28949