Sparkshop Arbitrary Code Execution Vulnerability via Crafted Phar File

A vulnerability allowing remote code execution has been identified in Sparkshop versions 1.1.7 and prior. This issue arises from the application's ability to process specially crafted Phar files, which can be exploited by an attacker to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Sparkshop is running.

Reproduction

The vulnerability can be reproduced by uploading a crafted Phar file to a Sparkshop instance running version 1.1.7 or prior. The application will execute the code embedded in the Phar file, leading to arbitrary code execution on the server.