Files added to tar with Phar::buildFromIterator have all-access permissions
At a glance
Severity
MEDIUM 5.5
EPSS
EPSS 1.59 % · percentile 76 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
php
NVD status
Modified
Description
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
