Arbitrary File Injection in PHP TAR Archive Parsing by PHP

CVE-2026-6103

What is CVE-2026-6103?

A security issue exists within the phar_tar_number() function in PHP, which improperly parses the octal size field of TAR headers without adequate overflow checks. This limitation allows for an overflow when the size exceeds the expected range, leading to an incorrect calculation of data blocks. Consequently, this can result in the processing of maliciously crafted TAR archives, permitting an attacker to inject arbitrary entries that are mistakenly treated as legitimate. This vulnerability poses a risk to systems processing TAR files via PHP, necessitating prompt attention to mitigate potential exploitation.

References