CVE-2026-6103
Description
A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causing the parser to miscalculate data boundaries and treat file content as valid header data. This allows an attacker to inject unauthorized entries that the application extracts as authentic files, potentially leading to unauthorized data modification.
Statement
This vulnerability is rated Moderate because a crafted TAR archive can cause PHP's Phar TAR parser to mishandle oversized size fields and inject archive entries, undermining integrity of extracted content. Exploitation requires an application to open or extract an untrusted archive (for example via PharData or phar://).
Mitigation
Do not open or extract untrusted TAR/Phar archives with PharData or phar:// streams. Validate package archives with independent tooling before extraction, and restrict write destinations used for extracted content.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | 3.3 | 4.3 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | Low | None |
| User Interaction | None | None | None |
| Scope | Changed | Unchanged | Changed |
| Confidentiality | None | None | None |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
