Packagist/drupal/core CVE-2019-6339: unknown, EPSS 35.95%

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI.

Action: Upgrade drupal/core to 8.5.9 or later.

composer require drupal/core:8.5.9

composer require drupal/core:8.6.6

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2019-002
• https://www.drupal.org/sa-core-2019-002

CVE-2019-6339 · published 2019-01-16T17:17:12Z · modified 2026-09-19T21:53:11Z · JSON