CVE-2019-7743
highpriority · track · 40EPSS 0.027 · 86 %ileEUUSEPSS · scored 2026-10-28
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-5m3w-rvvh-8fx6Joomla! Object Injection Vulnerability2022-05-13ghsa · osvUS
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.securityfocus.com/bid/107050cnnvd
- https://developer.joomla.org/security-centre/770-20190206-core-implement-the-typo3-phar-stream-wrappercnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-7743cnnvd
- https://www.securityfocus.com/bid/107050cnnvd
- http://www.securityfocus.com/bid/107050enisa_euvd
- https://developer.joomla.org/security-centre/770-20190206-core-implement-the-typo3-phar-stream-wrapperenisa_euvd
- http://www.securityfocus.com/bid/107050Third Party AdvisoryVDB Entrynvd
- https://developer.joomla.org/security-centre/770-20190206-core-implement-the-typo3-phar-stream-wrapperVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan