Drupal Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2019-11831 - Vulnerability Database

Drupal

Drupal Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2019-11831

Critical

Reference: CVE-2019-11831

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-11831

Title: Drupal Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability

Overview:

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal which allows attackers to bypass a deserialization protection mechanism as demonstrated by a phar:///path/bad.phar/../good.phar URL.