Launchpad.net

CVE 2020-28948

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

See the CVE page on Mitre.org for more details.