vetkit.php.deserialization.phar-metadata
A file-metadata function receives a path fully controlled by request input. On PHP < 8 a phar:// path triggers deserialization of the archive metadata (object injection).
Last updated:
Suite: Security
php
A file-metadata function receives a path fully controlled by request input. On PHP < 8 a phar:// path triggers deserialization of the archive metadata (object injection).
Category: SECURITY · Engine rule severity: INFO
How to fix it
Prefix user-supplied names with a fixed directory, reject stream wrappers (://) and upgrade to PHP 8+.
References
Source: packages/engine/rules/sast/php.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.