CVE-2019-11831
Directory Traversal in typo3/phar-stream-wrapper
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
CVE-2019-11831- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22, CWE-502
- Updated
- 2026-11-02
CVE List No score
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
CVE-2019-11831- Updated
- 2026-11-02
EUVDEUVD-2021-2136 No score
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
EUVD-2021-2136- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xv7v-rf6g-xwrc
Directory Traversal in typo3/phar-stream-wrapper
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
GHSA-xv7v-rf6g-xwrc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-502
- Updated
- 2026-11-02
OSV
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
CVE-2019-11831- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-xv7v-rf6g-xwrc
Directory Traversal in typo3/phar-stream-wrapper
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
GHSA-xv7v-rf6g-xwrc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11831
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
- Record
UBUNTU-CVE-2019-11831- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDRUPAL-CORE-2019-007 No score
This security release fixes third-party dependencies included in or required by Drupal core. As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor:
In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. [...]
The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file.
The known vulnerability in Drupal core requires the "administer themes" permission. However, additional vulnerabilities may exist in contributed or custom modules, so site should still update even if they do not grant this permission.
- Record
DRUPAL-CORE-2019-007- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/phar-stream-wrapperPackagist |
2.0.0 up to 2.1.1 | 2.1.1 |
typo3/phar-stream-wrapperPackagist |
3.0.0 up to 3.1.1 | 3.1.1 |
drupal/corePackagist |
7.0.0 up to 7.67.0 | 7.67.0 |
drupal/corePackagist |
8.0.0 up to 8.6.16 | 8.6.16 |
drupal/corePackagist |
8.7.0 up to 8.7.1 | 8.7.1 |
drupal/drupalPackagist |
7.0.0 up to 7.67.0 | 7.67.0 |
drupal/drupalPackagist |
8.0.0 up to 8.6.16 | 8.6.16 |
drupal/drupalPackagist |
8.7.0 up to 8.7.1 | 8.7.1 |
drupal7Debian:8 From an advisory covering 2 CVEs |
before 7.32-1+deb8u17, plus listed versions 7.32-1+deb8u107.32-1+deb8u117.32-1+deb8u127.32-1+deb8u137.32-1+deb8u14 Show 11 moreShow less7.32-1+deb8u157.32-1+deb8u167.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u57.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u77.32-1+deb8u87.32-1+deb8u9 |
7.32-1+deb8u17 |
drupal/corePackagist |
8.0.0 up to 8.6.16, 8.7.0 up to 8.7.1, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
8.6.168.7.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
drupal7Debian:9 |
before 7.52-2+deb9u9, plus listed versions 7.52-27.52-2+deb9u17.52-2+deb9u27.52-2+deb9u37.52-2+deb9u4 Show 4 moreShow less7.52-2+deb9u57.52-2+deb9u67.52-2+deb9u77.52-2+deb9u8 |
7.52-2+deb9u9 |
typo3/phar-stream-wrapperPackagist |
2.0.0 up to 2.1.1, plus listed versions v2.0.0v2.0.1v2.1.0 |
2.1.1 |
typo3/phar-stream-wrapperPackagist |
3.0.0 up to 3.1.1, plus listed versions v3.0.0v3.0.1v3.1.0 |
3.1.1 |
drupal/corePackagist |
8.0.0 up to 8.6.16, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
8.6.16 |
drupal/drupalPackagist |
8.0.0 up to 8.6.16, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
8.6.16 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11831 is a critical vulnerability (CVSS 9.8) in Typo3 Pharstreamwrapper, published May 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.44%, the 92nd percentile. Fixed in typo3/phar-stream-wrapper 2.1.1.
References
drupal.org/sa-core-2019-007
github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1
typo3.org/security/advisory/typo3-psa-2019-007
synology.com/security/advisory/Synology_SA_19_22
securityfocus.com/bid/108302
Show 24 moreShow less
debian.org/security/2019/dsa-4445
seclists.org/bugtraq/2019/May/36
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523
lists.debian.org/debian-lts-announce/2019/05/msg00029.html
nvd.nist.gov/vuln/detail/CVE-2019-11831
ubuntu.com/security/CVE-2019-11831
cve.org/CVERecord?id=CVE-2019-11831
Left out here: 150 versions. The JSON record has them.