CVE-2019-11831: Debian Linux

Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days.

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Drupal Drupal: from 7.0, before 7.67 (fixed in 7.67); from 8.6.0, before 8.6.16 (fixed in 8.6.16); from 8.7.0, before 8.7.1 (fixed in 8.7.1)
• Fedoraproject Fedora: version 28 only; version 29 only; version 30 only
• Joomla! Joomla!: from 3.9.3, up to and including 3.9.5
• TYPO3 Pharstreamwrapper: from 2.0.0, before 2.1.1 (fixed in 2.1.1); from 3.0.0, before 3.1.1 (fixed in 3.1.1)

Published 2019-05-09. Last modified 2026-06-17.