CVE-2019-9021

PHAR is a way PHP can package and load files inside an archive. In this bug, when PHP reads a PHAR archive’s file name, it doesn’t always stop at the end of the name, so it can accidentally read extra memory. That extra data can contain sensitive information, like parts of data the program had in memory.

This matters if you run PHP (and the PHAR extension) on your servers, especially for any application that can receive or process PHAR archives. It’s a risk because attackers don’t need a login and don’t require you to take any special action beyond having an internet-reachable PHP process that handles attacker-controlled PHAR content. It is only a practical risk when the attacker can influence PHAR archive content that your PHP instance processes.

Mark this as urgent because it is remotely reachable and does not require authentication, and public exploit code exists. The PHAR extension is enabled by default in affected PHP versions, which lowers the barrier for exposure. The current verdict is AMBER, so you should patch quickly and prioritize any internet-facing apps that may process uploaded or downloaded PHAR archives.

Confirm exposure

1. Identify your PHP version (from your server package manager or by running php -v).
2. Confirm whether the PHAR extension is enabled (commonly this is on by default in affected versions). If you use phpinfo(), check for the PHAR module/extension.
3. Review your applications and endpoints for anything that:
   • accepts user uploads of PHAR files, or
   • downloads and then processes PHAR archives, or
   • scans/loads PHAR content based on user input.

Match against fixed versions

• Upgrade PHP to one of the fixed versions:
  • PHP 5.6.40 or later
  • PHP 7.1.26 or later
  • PHP 7.2.14 or later
  • PHP 7.3.1 or later

Upgrade / remediation steps

1. Plan the PHP upgrade (test in staging first if you can) and deploy the fixed version to production.
2. After upgrading, re-check that:
   • your PHP version is now on/above the fixed release, and
   • PHAR is still enabled only where required by your applications.

Temporary workaround if you must delay patching

• Block or disable any feature that allows an attacker to supply PHAR archives to your PHP application (e.g., block PHAR uploads and reject PHAR-containing requests).
• If your application is only meant to handle specific file types, add strict allow-list validation and reject unexpected archive formats.

Monitor

• Watch web/app logs for requests involving PHAR uploads or attempts to trigger PHAR parsing.
• If you have a security logging pipeline, alert on unusual file upload types or archive-processing behavior.

CISA due date

• Not provided (CVE is not listed in CISA KEV in the provided findings).

Severity is high (described as critical in scoring) and the mechanism is a memory safety bug: a heap-based buffer over-read in PHAR filename parsing. During PHAR archive parsing, PHP can fail to stop reading after the end of a valid filename, causing it to read beyond the actual data boundary.

From the findings:

• Authentication is not required.
• No user interaction is needed.
• The PHAR extension is enabled by default in affected PHP versions.
• The attacker needs the ability to influence PHAR archive content that the vulnerable PHP instance processes.

Exploitation status:

• Public exploit code is available (1 known).
• CISA KEV: not listed in the provided findings.

Note: EPSS is a prediction and is not used to drive the remediation urgency here; exploitation-related findings and the exposure conditions drive the AMBER priority.