In CiviCRM prior to 5.21.3 and 5.22.x up to and including 5.24.x prior to 5.24.3, users may be able to upload and execute a crafted PHAR archive.
civicrm civicrm