CVE-2026-6103 Overview
CVE-2026-6103 is an integer overflow vulnerability [CWE-190] in the PHP phar_tar_number() function. The function parses the octal size field of a TAR header into a uint32_t without any overflow check. The TAR size field spans 11 octal digits and holds values up to 0x1FFFFFFFF, so any size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header. A crafted archive can inject entries that PharData reports and extracts as if they were genuine.
Critical Impact
Attackers can smuggle hidden file entries into TAR-based Phar archives, causing PharData to extract attacker-defined files that bypass archive integrity assumptions.
Affected Products
- PHP php-src (Phar extension, TAR archive handling)
- Applications using PharData to list or extract TAR archives from untrusted sources
- Any PHP runtime invoking phar_tar_number() during archive parsing
Discovery Timeline
- 2026-09-25 - CVE-2026-6103 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-6103
Vulnerability Analysis
The defect lies in how the Phar extension decodes the TAR header size field. TAR headers store file size as an ASCII octal string up to 11 digits wide, allowing values up to 0x1FFFFFFFF (approximately 8.5 GB). phar_tar_number() converts the field into a uint32_t, which caps at 0xFFFFFFFF. When the declared size exceeds the 32-bit range, the arithmetic wraps and the parser computes an incorrect block count to skip.
Because TAR archives are stream-oriented with fixed 512-byte blocks, miscounting the skip length desynchronizes the parser. The next bytes read as a header are actually attacker-controlled payload data from the oversized file entry. PharData then treats those bytes as a legitimate header, exposing additional file entries that were never declared at the archive boundary.
Root Cause
The root cause is missing bounds validation on the parsed octal value before storing it in a 32-bit unsigned integer. The function fails to reject sizes outside the representable range or to promote the value to a 64-bit type.
Attack Vector
Exploitation requires an attacker to supply a crafted TAR or Phar archive to a PHP application that parses it with PharData. The attack is local in CVSS terms because an input archive must reach the vulnerable code path. The scope changes because smuggled entries bypass the trust boundary that archive consumers assume. Impact is limited to integrity: attackers can inject file entries, but confidentiality and availability are not directly affected.
The vulnerability manifests entirely in header parsing logic. See the GitHub Security Advisory GHSA-j3wh-g957-2m85 for technical details and upstream patch references.
Detection Methods for CVE-2026-6103
Indicators of Compromise
- TAR or Phar archives containing entries where the size field exceeds 0xFFFFFFFF (greater than 11 octal digits of non-zero value or encoded with base-256 extensions).
- Extracted directories containing files that do not appear in the archive's declared manifest or that overwrite unexpected paths.
- PHP applications logging PharData extraction counts that exceed the number of entries declared by trusted upstream tooling.
Detection Strategies
- Pre-scan untrusted archives with a reference TAR implementation and compare the entry list against what PharData reports.
- Instrument PHP applications to log every path extracted from PharData::extractTo() and alert on unexpected entries.
- Flag archives containing any member whose declared size exceeds a policy threshold such as 4 GB.
Monitoring Recommendations
- Monitor web application file upload pipelines for TAR, PHAR, and TAR.GZ submissions from untrusted users.
- Track process execution originating from directories populated by PharData extraction operations.
- Correlate archive processing events with subsequent file writes outside expected output directories.
How to Mitigate CVE-2026-6103
Immediate Actions Required
- Inventory PHP applications that call PharData, Phar::buildFromIterator, or related TAR parsing APIs on untrusted input.
- Apply the PHP security update referenced in the upstream advisory as soon as it is available for your distribution.
- Restrict archive uploads to authenticated users and validate archive contents with an out-of-process scanner before extraction.
Patch Information
Refer to the PHP Security Advisory GHSA-j3wh-g957-2m85 for fixed versions and upstream commits. Update to the patched PHP release for your branch and redeploy affected applications.
Workarounds
- Reject TAR and Phar archives containing any entry with a declared size greater than 4 GB before passing them to PharData.
- Perform archive extraction in a sandboxed, non-privileged process with a chrooted or container-isolated output directory.
- Where feasible, replace PharData TAR handling with a hardened third-party TAR library that validates size fields against 64-bit bounds.
# Verify installed PHP version against the patched release
php -v
# Example: disable the Phar extension where it is not required
# (Debian/Ubuntu)
sudo phpdismod phar
sudo systemctl restart php-fpm
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.