Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2024-8926

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.30affected
  • 8.2.* to < 8.2.24affected
  • 8.3.* to < 8.3.12affected

References