CVE-2026-6735

EUVD-2026-28967
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
phpCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
phpphp
8.2.* ≤
𝑥
< 8.2.31
CNA
phpphp
8.3.* ≤
𝑥
< 8.3.31
CNA
phpphp
8.4.* ≤
𝑥
< 8.4.21
CNA
phpphp
8.5.* ≤
𝑥
< 8.5.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
vulnerable
bullseye (security)
vulnerable
php8.2
bookworm
vulnerable
bookworm (security)
8.2.31-1~deb12u1
fixed
php8.4
forky
vulnerable
sid
8.4.21-1
fixed
trixie
vulnerable
trixie (security)
8.4.21-1~deb13u1
fixed