Composer pear/archive_tar has 6 known advisories in the phpwarden feed, 2 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-28949 KEV | Potential file overwrite if archive filename starts with file:// | unknown | 0.0 | <1.4.11 | 1.4.11 |
| CVE-2020-36193 KEV | Directory Traversal in Archive_Tar | high | 7.5 | <1.4.13 or <1.4.12 | 1.4.13 |
| CVE-2021-32610 | Directory Traversal in Archive_Tar | high | 7.1 | <1.4.14 | 1.4.14 |
| CVE-2020-28948 | Multiple vulnerabilities through filename manipulation in Archive_Tar | high | 7.8 | <1.4.11 | 1.4.11 |
| CVE-2018-1000888 | Archive_Tar contains Potential RCE if filename starts with phar:// | high | 8.8 | <1.4.4 | 1.4.4 |
| CVE-2006-0931 | PEAR::Archive_Tar Directory Traversal vulnerability | critical | 9.1 | >=1.2 and <1.3.2 | 1.3.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked