Skip to content
OpenAdvisories

Package · Packagist

typo3/phar-stream-wrapper

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium —
    GHSA-4v5g-8pq2-32m2

    By-passing Protection of PharStreamWrapper Interceptor

    Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vect…

    typo3/phar-stream-wrapper Packagist
  • Critical 9.8
    CVE-2019-11831

    Directory Traversal in typo3/phar-stream-wrapper

    The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/.…

    drupal/core drupal/drupal drupal7 drupal7 Ubuntu Alpine Packagist
  • Critical 9.8
    CVE-2019-11830

    PharStreamWrapper for Typo3 unsafe deserialization vulnerability

    PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.

    typo3/phar-stream-wrapper Packagist