← Back

Pharstreamwrapper

pharstreamwrapper

Vendor: Typo3 • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-11831
5Debian
DrupalFedoraproject+2 more
5Debian Linux
DrupalFedora+2 more
Jun 17, 2026
May 9, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as de...Show more
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.Show less
CVE-2019-11830
1Typo3
1Pharstreamwrapper
Jun 17, 2026
May 9, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protecti...Show more
PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.Show less