In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.
{ "severity": "High", "cpes": [ "cpe:2.3:a:civicrm:civicrm:*:*:*:*:*:*:*:*" ] }