LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28948: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-28948 is a flaw in PEAR Archive_Tar through 1.4.10. A lowercase block for phar: could be bypassed with uppercase PHAR:, enabling an unserialization attack in affected PHP software. Business urgency depends on whether exposed applications use vulnerable Archive_Tar code paths with attacker-controlled input.

Executive priority

Prioritize as a dependency remediation item for PHP and Drupal estates, especially public systems handling uploaded or imported archives. The absence of CVSS and KEV evidence limits certainty, but unserialization issues can carry material impact when reachable.

Technical view

The issue is a case-sensitivity bypass in Archive_Tar's phar stream-wrapper filtering. Sources state phar: was blocked while PHAR: was not, allowing an unserialization attack. The bundle does not provide CVSS, CWE, complete affected CPEs, or a detailed exploitability precondition matrix.

Likely exposure

Most likely exposure is PHP applications or distributions bundling PEAR Archive_Tar through 1.4.10, including environments covered by Drupal, Debian, Fedora, and Gentoo advisories. Confirm locally because the bundle lists generic affected data only.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. Treat exploitation status as unconfirmed. Risk increases where untrusted archive paths, filenames, or package inputs can reach vulnerable Archive_Tar handling.

Researcher notes

Key uncertainty is reachability. Validate the exact Archive_Tar version, packaging source, and whether attacker-influenced data can trigger the affected PHAR handling. Do not assume active exploitation or remote code execution without local evidence or vendor confirmation.

Mitigation direction

  • Inventory PEAR Archive_Tar versions in PHP applications and OS packages.
  • Update Archive_Tar past 1.4.10 or apply vendor package updates.
  • Review Drupal, Debian, Fedora, and Gentoo advisories for environment-specific fixes.
  • Prioritize internet-facing PHP systems that process user-supplied archives.
  • If no package update is available, seek current vendor guidance.

Validation and detection

  • Check dependency manifests and installed packages for Archive_Tar through 1.4.10.
  • Confirm whether Drupal or distribution advisories apply to deployed systems.
  • Review application flows for user-controlled archive input reaching Archive_Tar.
  • Verify patched package versions after updates.
  • Record compensating controls if vulnerable code remains temporarily deployed.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-28948 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
12Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.