blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-8925

MEDIUM 5.3 CVSS 3.1
Published
October 8, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-444
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Affected products and versions

  • PHP — From 8.1.0 (including) to 8.1.30 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.24 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.12 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 Exploit, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html
  • security.netapp.com https://security.netapp.com/advisory/ntap-20241101-0003/
  • nvd.nist.gov Official NVD record