CVE-2026-6103

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causing the parser to miscalculate data boundaries and treat file content as valid header data. This allows an attacker to inject unauthorized entries that the application extracts as authentic files, potentially leading to unauthorized data modification.

This vulnerability is rated Moderate because a crafted TAR archive can cause PHP's Phar TAR parser to mishandle oversized size fields and inject archive entries, undermining integrity of extracted content. Exploitation requires an application to open or extract an untrusted archive (for example via PharData or phar://).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not open or extract untrusted TAR/Phar archives with PharData or phar:// streams. Validate package archives with independent tooling before extraction, and restrict write destinations used for extracted content.