blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2023-3823

HIGH 7.5 CVSS 3.1
Published
August 11, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-611
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.

Affected products and versions

  • PHP — From 8.0.0 (including) to 8.0.30 (excluding)
  • PHP — From 8.1.0 (including) to 8.1.22 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.9 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr Exploit, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html Mailing List
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ Mailing List
  • security.netapp.com https://security.netapp.com/advisory/ntap-20230825-0001/ Third Party Advisory
  • nvd.nist.gov Official NVD record