Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2019-11044

link() silently truncates after a null byte on Windows

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.2.x to < 7.2.26affected
  • 7.3.x to < 7.3.13affected
  • 7.4.x to < 7.4.1affected

References