GHSA-j66p-fvp2-fxhj: 
PHP vulnerability analysis and mitigation

The Drupal core vulnerability (GHSA-j66p-fvp2-fxhj) is a critical arbitrary PHP code execution flaw discovered in the PEAR Archive_Tar library used by Drupal. The vulnerability was disclosed on November 25, 2020, affecting multiple versions of Drupal including versions 7.x, 8.x, and 9.x. This security issue impacts Drupal installations configured to allow and process .tar, .tar.gz, .bz2, or .tlz file uploads (Drupal Advisory).

The vulnerability received a High severity rating with a CVSS score of 7.8. The CVSS metrics indicate a local attack vector, low attack complexity, no privileges required, and user interaction is required. The vulnerability can lead to unauthorized access with high impact on confidentiality, integrity, and availability. The issue is tracked under CVE-2020-28948 and CVE-2020-28949, specifically affecting Drupal versions >= 7.0.0 < 7.75, >= 8.0.0 < 8.8.12, >= 8.9.0 < 8.9.10, and >= 9.0.0 < 9.0.9 (GitHub Advisory).

The vulnerability allows for arbitrary PHP code execution in affected Drupal installations. When exploited, it can lead to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected system. The vulnerability is particularly critical for systems that allow processing of tar, tar.gz, bz2, or tlz file uploads (Drupal Advisory).

The vulnerability requires user interaction and local access for exploitation. According to the Drupal Security Advisory, there were known exploits for one of core's dependencies at the time of disclosure, which prompted an out-of-schedule security release (Drupal Advisory).

As an immediate mitigation, administrators are advised to prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files. For a permanent fix, users should upgrade to patched versions: Drupal 9.0.9 for 9.x users, Drupal 8.9.10 for 8.9.x users, Drupal 8.8.12 for 8.8.x users, and Drupal 7.75 for 7.x users. Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage (Drupal Advisory).