blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11044

HIGH 7.5 CVSS 3.1
Published
December 23, 2019
Last modified
August 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-170
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Affected products and versions

  • PHP — From 7.2.0 (including) to 7.2.26 (including)
  • PHP — From 7.3.0 (including) to 7.3.13 (including)
  • PHP versions 7.4.0

References

  • bugs.php.net https://bugs.php.net/bug.php?id=78862 Exploit, Mailing List, Patch, Vendor Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Third Party Advisory
  • nvd.nist.gov Official NVD record