CVE-2026-17543

EUVD-2026-51090
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
phpCNA
8.1 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
phpphp
8.2.* ≤
𝑥
< 8.2.33
CNA
phpphp
8.3.* ≤
𝑥
< 8.3.33
CNA
phpphp
8.4.* ≤
𝑥
< 8.4.24
CNA
phpphp
8.5.* ≤
𝑥
< 8.5.9
CNA
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
vulnerable
bullseye (security)
vulnerable
php8.2
bookworm
vulnerable
bookworm (security)
vulnerable
php8.4
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4