> To make the attack work, a miscreant would need to upload a booby-trapped file onto the target application, then trigger a file operation through a crafted file name (that accesses the file through the phar:// stream wrapper), causing the target application to "unserialize" metadata contained in the file.
The flaw by itself would not allow an attacker to break into a targeted system and only expands the scope for mischief once a toehold on targeted systems is obtained through some other means.