A vulnerability in the Drupal web content management system can be exploited to allow arbitrary code execution, affecting almost a million websites.

A security advisory from Drupal describes how this critical vulnerability can be exploited to perform arbitrary execution of PHP code.  Security patches are available for Drupal versions 7, 8 and 9.

The problem exists within the PEAR Archive_Tar third party library which Drupal uses to decompress certain file types (.tar,.tar.gz, .bz2 and .tlz).   As a mitigation, system administrators can configure Drupal not to accept these file types until the patches have been applied.

Any other PHP applications that use the PEAR Archive_Tar library will be similarly vulnerable until the updated library is installed.  The vulnerability is described in detail in the problem report on GITHub which covers CVE-2020-28948 and CVE-2020-28949.

Whether or not you use Drupal, this problem highlights a risk of using third party libraries in your software projects – they require careful monitoring to ensure any vulnerabilities discovered in the library are promptly applied to your own systems in order to resolve the security vulnerability.

Security Managers are advised to ensure dependent software libraries which are imported into in-house developed systems are monitored for inclusion in monthly patch cycles alongside traditional applications and operating system updates.