blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-6735

HIGH 7.3 CVSS 4.0
Published
May 10, 2026
Last modified
July 24, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-79
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

Affected products and versions

  • PHP — From 8.2.0 (including) to 8.2.31 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.31 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.21 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.6 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv Exploit, Vendor Advisory
  • nvd.nist.gov Official NVD record