Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fil

Summary

Archive_Tar, a PHP library for reading and writing tar archives, is affected. Attackers can craft archive filenames using other stream-wrapper prefixes such as file:// to bypass the existing protection, potentially allowing them to overwrite arbitrary files on the system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Nov 19, 2020, 6:14 PM UTCCVE published
2. Aug 25, 2022Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Sep 15, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:35 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• drupal/corePackagist

  From 8.0.0 · fixed in 8.8.12; From 8.9.0 · fixed in 8.9.10; From 9.0.0 · fixed in 9.0.9

• pear/archive_tarPackagist

  fixed in 1.4.11

References 12