CVE-2020-7063: PHAR Permissions Vulnerability in PHP

The core impact of CVE-2020-7063 lies in the potential for unintended file permission changes. When a PHAR archive is created using the vulnerable function, files added to the archive inherit default permissions (0666), regardless of the original file permissions on the system. This means that files extracted from the archive could have broader access than intended, allowing unauthorized users or processes to read, write, or execute them. This is particularly concerning in environments where file permissions are carefully managed to restrict access to sensitive data or critical system files. A malicious actor could craft a PHAR archive containing files with elevated permissions, then distribute it to compromise systems that extract the archive. While not a direct remote code execution vulnerability, it can be a stepping stone for privilege escalation or data exfiltration.

1. Reserved2020-01-15
2. Published2020-02-27
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-7063 is to upgrade to a patched version of PHP. Specifically, upgrade to PHP 7.4.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to carefully review and adjust file permissions after extracting PHAR archives. Another is to avoid using PharData::buildFromIterator() if possible, opting for alternative methods of creating PHAR archives that preserve original file permissions. Web application firewalls (WAFs) might be configured to inspect PHAR archive uploads and block those with suspicious permissions, but this is a less reliable defense. There are no specific Sigma or YARA rules readily available for this vulnerability, as detection relies primarily on identifying the use of the vulnerable function and subsequent permission anomalies.