CVE-2018-1000888: High severity PHP Pear Archive Tar vulnerability
Last updated 25 August 2025
Other sources
PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader['filename'] as parameter (such as fileexists, isfile, isdir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with phar://[pathtomaliciouspharfile] as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the ArchiveTar class itself. With ArchiveTar object injection, arbitrary file deletion can occur because @unlink($this->temptarname) is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.
— Launchpad
Potential RCE if filename starts with phar://
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000888?
CVE-2018-1000888 is classified as a CWE-502 and CWE-915 vulnerability, indicating it poses a significant risk due to improper file handling.
How do I fix CVE-2018-1000888?
To mitigate CVE-2018-1000888, upgrade PEAR Archive_Tar to version 1.4.4 or later.
Which versions of Archive_Tar are affected by CVE-2018-1000888?
CVE-2018-1000888 affects PEAR Archive_Tar version 1.4.3 and earlier.
Is my system vulnerable to CVE-2018-1000888?
If you are using PEAR Archive_Tar version 1.4.3 or earlier, your system is vulnerable to CVE-2018-1000888.
What is the impact of exploiting CVE-2018-1000888?
Exploiting CVE-2018-1000888 could allow an attacker to manipulate file operations leading to unauthorized file access or denial of service.