CVE-2018-17057 (PHP, published 2018-09-14T20:29Z)
Description: value: An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/tecnickcom/TCPDF
Files changed:
CHANGELOG.TXT
composer.json
include/tcpdf_fonts.php
include/tcpdf_images.php
include/tcpdf_static.php
tcpdf.php
Commit message: Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data.


Vulnerable code:
  "version": "6.2.19",
		if (!file_exists($fontfile)) {
		if (@file_exists($outpath.$font_name.'.php')) {
		if (($fontdir !== false) AND @file_exists($fontdir.$file)) {
		} elseif (@file_exists(self::_getfontpath().$file)) {
		} elseif (@file_exists($file)) {
		if (!@file_exists($file)) {
			if (@file_exists($tfile)) {
	private static $tcpdf_version = '6.2.19';
		//var_dump($alt);exit;//DEBUG
    

// Version     : 6.2.19
 * @version 6.2.19
 * @version 6.2.19
		if (TCPDF_STATIC::empty_string($fontfile) OR (!@file_exists($fontfile))) {
		if (!TCPDF_STATIC::empty_string($fontfile) AND (@file_exists($fontfile))) {
				AND (@file_exists($opt['FS']) OR TCPDF_STATIC::isValidURL($opt['FS']))
		if (isset($opt['mk']['i']) AND @file_exists($opt['mk']['i'])) {
		if (isset($opt['mk']['ri']) AND @file_exists($opt['mk']['ri'])) {
		if (isset($opt['mk']['ix']) AND @file_exists($opt['mk']['ix'])) {
			$wrappers = stream_get_wrappers();
			foreach ($wrappers as $wrapper) {
				if ($wrapper === 'http' || $wrapper === 'https') {
					continue;
				}
				if (stripos($file, $wrapper.'://') === 0) {
					$this->Error('Stream wrappers in file paths are not supported');
				}
			}
			if (!@file_exists($file)) {
				if (@file_exists($tfile)) {

Fixed code:
6.2.20
	- Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data.

  "version": "6.2.20",
		if (!TCPDF_STATIC::file_exists($fontfile)) {
		if (@TCPDF_STATIC::file_exists($outpath.$font_name.'.php')) {
		if (($fontdir !== false) AND @TCPDF_STATIC::file_exists($fontdir.$file)) {
		} elseif (@TCPDF_STATIC::file_exists(self::_getfontpath().$file)) {
		} elseif (@TCPDF_STATIC::file_exists($file)) {
		if (!@TCPDF_STATIC::file_exists($file)) {
			if (@TCPDF_STATIC::file_exists($tfile)) {
	private static $tcpdf_version = '6.2.20';
	/**
	 * Wrapper for file_exists.
	 * Checks whether a file or directory exists.
	 * Only allows some protocols and local files.
	 * @param filename (string) Path to the file or directory. 
	 * @return Returns TRUE if the file or directory specified by filename exists; FALSE otherwise.  
	 * @public static
	 */
	public static function file_exists($filename) {
		if (strpos($filename, '://') > 0) {
			$wrappers = stream_get_wrappers();
			foreach ($wrappers as $wrapper) {
				if (($wrapper === 'http') || ($wrapper === 'https')) {
					continue;
				}
				if (stripos($filename, $wrapper.'://') === 0) {
					return false;
				}
			}
		}
		return @file_exists($filename);
	}

			if (!self::file_exists($path)) {
				return false;
			}
// Version     : 6.2.20
 * @version 6.2.20
 * @version 6.2.20
		if (TCPDF_STATIC::empty_string($fontfile) OR (!@TCPDF_STATIC::file_exists($fontfile))) {
		if (!TCPDF_STATIC::empty_string($fontfile) AND (@TCPDF_STATIC::file_exists($fontfile))) {
				AND (@TCPDF_STATIC::file_exists($opt['FS']) OR TCPDF_STATIC::isValidURL($opt['FS']))
		if (isset($opt['mk']['i']) AND @TCPDF_STATIC::file_exists($opt['mk']['i'])) {
		if (isset($opt['mk']['ri']) AND @TCPDF_STATIC::file_exists($opt['mk']['ri'])) {
		if (isset($opt['mk']['ix']) AND @TCPDF_STATIC::file_exists($opt['mk']['ix'])) {
			if (!@TCPDF_STATIC::file_exists($file)) {
				if (@TCPDF_STATIC::file_exists($tfile)) {