CVE-2026-17545
EUVD-2026-8732925.09.2026, 21:17
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| php | php | 8.2.0 ≤ 𝑥 < 8.2.34 |
| php | php | 8.3.0 ≤ 𝑥 < 8.3.35 |
| php | php | 8.4.0 ≤ 𝑥 < 8.4.26 |
| php | php | 8.5.0 ≤ 𝑥 < 8.5.11 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| php5 |
| ||||||||
| php7.0 |
| ||||||||
| php7.2 |
| ||||||||
| php7.4 |
| ||||||||
| php8.1 |
| ||||||||
| php8.3 |
| ||||||||
| php8.5 |
|