CVE-2020-28949

What is PHAR Deserialization?

PHP's phar:// stream wrapper lets code transparently read files from inside a PHP Archive (.phar) package as if they were regular files. The security risk is that simply accessing a path through the phar:// wrapper — even via a function that's only supposed to check whether a file exists — causes PHP to parse and deserialize the archive's metadata, which can trigger PHP object injection if an attacker controls the archive's contents. This is a well-documented PHP vulnerability class, distinct from Archive_Tar's other 2020 issues (CVE-2020-36193 and CVE-2020-28948, also covered on this site), and affects any PHP application that passes attacker-influenced paths to filesystem functions without blocking the phar:// wrapper.

Overview

CVE-2020-28949 is a deserialization vulnerability in PEAR Archive_Tar caused by an incomplete fix for an earlier, related PHAR deserialization issue: the library's blocklist checked for the lowercase string phar: but not the uppercase variant PHAR:, and PHP's stream wrapper matching is case-insensitive — so an attacker could simply use PHAR:// to bypass the protection entirely (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High).

Technical Details

The underlying bug class (CWE-502, deserialization of untrusted data) requires an application using Archive_Tar to process an attacker-influenced path or filename in a way that reaches a filesystem-checking function. If an attacker can get such a path evaluated using the PHAR:// wrapper instead of the blocked lowercase phar://, PHP deserializes the referenced archive's metadata, and if the application has PHP classes in scope with exploitable __wakeup() or __destruct() magic methods, this can lead to arbitrary code execution — a classic "PHP object injection" chain.

Discovery

Reported through PEAR's bug tracker (bug #27002) as a bypass of a previous, incomplete Archive_Tar security fix; Drupal shipped SA-CORE-2020-013 to update its bundled copy of the library for affected sites.

Exploitation Context

This vulnerability underscores how incomplete fixes for a security issue — here, a case-sensitivity gap in a blocklist — can leave the underlying vulnerability class fully exploitable despite an apparent patch already being in place. CISA added the CVE to KEV in August 2022 based on confirmed exploitation.

Remediation

1. Update Archive_Tar to the version that fixes this specific bypass, not just the version that addressed the original, incomplete phar: blocklist fix — check your version against the patched release explicitly.
2. Update Drupal core to the release specified in SA-CORE-2020-013 if running a Drupal site with a bundled vulnerable Archive_Tar copy.
3. Prefer allowlists over blocklists for stream-wrapper filtering in any custom code handling user-influenced file paths — a case-insensitive bypass like this one is a recurring failure mode of blocklist-style security checks.
4. Audit for other PHP applications bundling Archive_Tar beyond Drupal, since this library is a common transitive dependency across the PHP ecosystem.