PharStreamWrapper for Typo3 unsafe deserialization vulnerability

CRITICAL 9.8CVE-2019-11830 · GHSA-3hxw-g85p-qgxm · Published 09/05/2019 · updated 17/06/2026

In short

CVE-2019-11830 is a CRITICAL (CVSS 9.8) vulnerability affecting typo3/phar-stream-wrapper, pharstreamwrapper (typo3).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.8% of all vulnerabilities.
Fix: update to 2.1.1, 3.1.1 or later.

Package	Affected versions	Patched versions
typo3/phar-stream-wrapper Packagist	`≥ 2.0.0, < 2.1.1≥ 3.0.0, < 3.1.1`	`2.1.13.1.1`
pharstreamwrapper typo3	`≥ 2.0.0, < 2.1.1≥ 3.0.0, < 3.1.1`	`2.1.13.1.1`

Description

PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.

NVD description

References

More vulnerabilities in typo3/phar-stream-wrapper

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free