The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal

Summary

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

Timeline

1. May 9, 2019, 3:52 AM UTCCVE published
2. Aug 4, 2024, 11:03 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• drupal/corePackagist

  From 8.0.0 · fixed in 8.6.16; From 8.7.0 · fixed in 8.7.1

• typo3/phar-stream-wrapperPackagist

  From 2.0.0 · fixed in 2.1.1

• typo3/phar-stream-wrapperPackagist

  From 3.0.0 · fixed in 3.1.1

• drupal/corePackagist

  From 7.0.0 · fixed in 7.67.0

• drupal/corePackagist

  From 8.0.0 · fixed in 8.6.16

• drupal/corePackagist

  From 8.7.0 · fixed in 8.7.1

• drupal/drupalPackagist

  From 7.0.0 · fixed in 7.67.0

• drupal/drupalPackagist

  From 8.0.0 · fixed in 8.6.16

• drupal/drupalPackagist

  From 8.7.0 · fixed in 8.7.1

References 15