Pear · Archive Tar · CVE-2020-28949
**Name of the Vulnerable Software and Affected Versions**
Archive Tar versions 1.4.10 and earlier
**Description**
The issue is related to the deserialization of untrusted data in the Archive Tar class of the PEAR PHP library. It allows a remote attacker to overwrite protected files using a specially crafted .tar archive, exploiting the insufficient sanitization of special elements in the output. The vulnerability can be exploited through stream-wrapper attacks, such as using `file://` to overwrite files, which are not fully addressed by the `://` filename sanitization.
**Recommendations**
For Archive Tar versions 1.4.10 and earlier, consider disabling the use of the Archive Tar class until a patch is available, or restrict access to the vulnerable `Archive Tar` component to minimize the risk of exploitation. Avoid using the `file://` stream wrapper in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.