$ cve CVE-2018-1000888 JSON

CVE-2018-1000888 EXPLOIT

8.8

HIGH · CVSS 3.0 · EPSS 19.1% (pctl 97)

Patch early

A public exploit exists.

Description

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.

Scoring

CVSS	8.8 (HIGH, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS	19.13% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	yes
Published	2018-12-28
Last modified	2026-06-17

Affected (3)

Vendor	Product
canonical	ubuntu linux
debian	debian linux
php	pear archive tar

Public exploits

Source	Title	Date
exploit-db	PEAR Archive_Tar < 1.4.4 - PHP Object Injection	2019-01-10

References

→ the Explorer · watch your stack · NVD