By Eduard Kovacs on January 17, 2019
Updates released on Wednesday for Drupal 7, 8.5 and 8.6 address two potentially serious vulnerabilities that can be exploited for arbitrary code execution.
One of the flaws has been described as a weakness that allows remote execution of arbitrary PHP code. The issue is related to the phar
stream wrapper built into PHP and how it handles untrusted phar://
“Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability,” Drupal developers explained in an advisory
. “This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.”