CVE-2020-7061: PHP

Critical severity, CVSS 9.1. EPSS: 4.1% chance of exploitation in the next 30 days.

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Affected products

• PHP PHP: from 7.2.0, up to and including 7.2.27; from 7.3.0, up to and including 7.3.14; from 7.4.0, up to and including 7.4.2
• Tenable Tenable.sc: before 5.19.0 (fixed in 5.19.0)

Published 2020-02-27. Last modified 2026-06-17.