Which products and versions are affected by CVE-2020-28948?

Affected: Drupal versions >= 7.0.0; Archive Tar (PHP); Debian Linux versions 10.0, 9.0, among others. The full list is in the CVE brief.

Is CVE-2020-28948 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2020-28948 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2020-28948?

No public exploit code is known.

Is there a fix for CVE-2020-28948?

Fixed versions are available, including apcu-panel 5.1.18-1.module+el8.3.0+7685+72d70b58, Drupal 7.75.0, Drupal 8.9.10.

How urgently should CVE-2020-28948 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

WatchlistHigh

CVE-2020-28948Drupal Insecure Deserialization

Deserialization of Untrusted Data in Archive_Tar

Published Apr 22, 2021 · Updated Sep 19, 2026 · Also known as BIT-drupal-2020-28948, BIT-drupal-2020-28949, DEBIAN-CVE-2020-28948, DLA-2465-1, DLA-2466-1, DRUPAL-CORE-2020-013, DSA-4817-1, GHSA-jh5x-hfhg-78jq, UBUNTU-CVE-2020-28948, USN-4654-1

Key Facts

Patch in the next maintenance window

CVE-2020-28948 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Drupal, Archive Tar (PHP), Debian Linux and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 47% probability of exploitation in the next 30 days.
Fixed versions are available, including apcu-panel 5.1.18-1.module+el8.3.0+7685+72d70b58, Drupal 7.75.0, Drupal 8.9.10.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Scores

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

47%

Higher than 98.8% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

46/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2020-28948
advisoryhttps://security-tracker.debian.org/tracker/CVE-2020-28948
advisoryhttps://ubuntu.com/security/CVE-2020-28948
advisoryhttps://www.cve.org/CVERecord?id=CVE-2020-28948
advisoryRHSA-2022:6541
advisoryRHSA-2022:6542

Description

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Affected Products

94 affected entries in total

Product	Affected versions	Fixed in
DrupalDrupal	>= 7.0.0	7.75
Archive TarPHP	See advisory	1.4.11
Debian LinuxDebian	10.0, 9.0	n/a
FedoraFedoraproject	32, 33, 34, 35	n/a
drupal7alpine	See advisory	7.75-r0

20 more affected products in the full CVE brief

Patched Releases

apcu-panel

5.1.18-1.module+el8.3.0+7685+72d70b58

Drupal

7.75.0, 8.9.10, 9.0.9, 7.75

drupal/core

8.8.12, 8.9.10, 9.0.9

drupal7

7.26-1ubuntu0.1+esm2, 7.44-1ubuntu1~16.04.0+esm2, 7.52-2+deb9u13, 7.75-r0

libzip

1.6.1-1.module_el8.6.0+2750+78feabcb, 1.6.1-1.module+el8.3.0+7685+72d70b58, 1.6.1-1.module+el8.6.0+789+2130c178

libzip-devel

1.6.1-1.module+el8.3.0+7685+72d70b58

libzip-tools

1.6.1-1.module+el8.3.0+7685+72d70b58

pear/archive_tar

1.4.11

php

7.4.19-4.module_el8.6.0+3238+624bf8b8, 7.4.19-4.module+el8.6.0+1006+0d5a469f, 7.4.19-4.module+el8.6.0+20746+7a133c42

Archive Tar

1.4.11

php-bcmath