drupal -- Drupal core - Moderately critical

Drupal Security Team reports:

CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.
In order to intercept file invocations like file_exists or stat on compromised Phar archives
the base name has to be determined and checked before allowing to be handled by PHP
Phar stream handling.
The current implementation is vulnerable to path traversal leading to scenarios where the
Phar archive to be assessed is not the actual (compromised) file.