GHSA-xv7v-rf6g-xwrc critical
Directory Traversal in typo3/phar-stream-wrapper
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.1.1ECOSYSTEM: introduced 3.0.0; fixed 3.1.1>=2.0.0,<2.1.1|>=3.0.0,<3.1.1Fixed versions: 2.1.1, 3.1.1
Vulnerability intelligence Composer
typo3/phar-stream-wrapper
Interceptors for PHP's native phar:// stream handling
Composer latest 4.0.0 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
4.0.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
3 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-3hxw-g85p-qgxm critical
PharStreamWrapper for Typo3 unsafe deserialization vulnerability
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.1.1ECOSYSTEM: introduced 3.0.0; fixed 3.1.1>=2.0.0,<2.1.1|>=3.0.0,<3.1.1Fixed versions: 2.1.1, 3.1.1
GHSA-4v5g-8pq2-32m2 moderate
By-passing Protection of PharStreamWrapper Interceptor
Affected range
ECOSYSTEM: introduced 1.0.0; fixed 2.0.1ECOSYSTEM: introduced 3.0.0; fixed 3.0.1>=1.0.0,<2.0.0|>=2.0.0,<2.0.1|>=3.0.0,<3.0.1Fixed versions: 2.0.1, 3.0.1