PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Airport | — | Apply OS X security update 2011-001Upgrade macOS to the latest versionApply OS X security update 2011-004 | Aug 28, 2015 | Jan 18, 2011 |
| Apple Osx Php | — | Upgrade macOS to the latest version | Dec 16, 2011 | Jan 18, 2011 |
| Centos_linux | — | Upgrade php-pgsqlUpgrade php-pdoUpgrade phpUpgrade php-cliUpgrade php-mbstringUpgrade php-ldapUpgrade php-develUpgrade php-xmlUpgrade php-gdUpgrade php-commonUpgrade php-dbaUpgrade php-imapUpgrade php-soapUpgrade php-ncursesUpgrade php-mysqlUpgrade php-bcmathUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-snmp | Dec 1, 2016 | Jan 18, 2011 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 20, 2013 |
| Freebsd | — | Upgrade php5Upgrade php52 | Dec 10, 2025 | Jan 13, 2011 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jan 18, 2011 |
| Hpux | — | Update hpuxws22APCH32.MOD_JK2 to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP2 to the latest versionUpdate hpuxws22APCH32.PHP to the latest versionUpdate hpuxws22APCH32.MOD_PERL to the latest versionUpdate hpuxws22APCH32.APACHE2 to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP to the latest versionUpdate hpuxws22APCH32.MOD_JK to the latest versionUpdate hpuxws22APCH32.WEBPROXY to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22APCH32.MOD_PERL2 to the latest versionUpdate hpuxws22APCH32.PHP2 to the latest versionUpdate hpuxws22APCH32.APACHE to the latest version | Aug 11, 2017 | Jan 18, 2011 |
| Oracle_linux | — | Upgrade php53-odbcUpgrade php53Upgrade php-ldapUpgrade php-enchantUpgrade php-bcmathUpgrade php-intlUpgrade php53-cliUpgrade php-ncursesUpgrade php-tidyUpgrade php-ztsUpgrade php53-imapUpgrade php-recodeUpgrade phpUpgrade php-pgsqlUpgrade php53-dbaUpgrade php53-gdUpgrade php53-snmpUpgrade php-snmpUpgrade php53-bcmathUpgrade php-embeddedUpgrade php-commonUpgrade php-odbcUpgrade php-imapUpgrade php53-pdoUpgrade php-pdoUpgrade php53-mysqlUpgrade php-develUpgrade php-xmlrpcUpgrade php-gdUpgrade php53-intlUpgrade php53-xmlUpgrade php-dbaUpgrade php-pspellUpgrade php53-ldapUpgrade php53-xmlrpcUpgrade php53-mbstringUpgrade php53-pgsqlUpgrade php53-processUpgrade php-cliUpgrade php-fpmUpgrade php53-pspellUpgrade php53-commonUpgrade php-processUpgrade php-mbstringUpgrade php-soapUpgrade php-mysqlUpgrade php-xmlUpgrade php53-soapUpgrade php53-devel | Oct 16, 2024 | Jan 18, 2011 |
| Php | — | Upgrade to PHP version 5.3.4 | Oct 1, 2012 | Jan 18, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 18, 2006 |
| Suse | — | Upgrade php5-domUpgrade php53-opensslUpgrade php5-zlibUpgrade php5-dbaUpgrade apache2-mod_php5Upgrade php5-wddxUpgrade php5-tokenizerUpgrade php53-fileinfoUpgrade php53-tokenizerUpgrade php5-ctypeUpgrade php53-exifUpgrade php53-ftpUpgrade php5-gdUpgrade php53-jsonUpgrade php53-pcntlUpgrade php5-sqliteUpgrade php5-pgsqlUpgrade php53-mysqlUpgrade php5-tidyUpgrade apache2-mod_php53Upgrade php53-sysvsemUpgrade php5-curlUpgrade php53Upgrade php53-intlUpgrade php5-iconvUpgrade php5-imapUpgrade php5-mbstringUpgrade php5-ldapUpgrade php53-wddxUpgrade php53-xslUpgrade php53-sysvmsgUpgrade php5-socketsUpgrade php53-develUpgrade php53-xmlwriterUpgrade php5-pearUpgrade php53-domUpgrade php5-xslUpgrade php7-develUpgrade php5-sysvshmUpgrade php53-pspellUpgrade php5-exifUpgrade php53-xmlrpcUpgrade php53-gmpUpgrade php5-suhosinUpgrade php53-soapUpgrade php5-bcmathUpgrade php5-sysvsemUpgrade php53-iconvUpgrade php53-fastcgiUpgrade php5-jsonUpgrade php53-dbaUpgrade php5-develUpgrade php5-shmopUpgrade php5-snmpUpgrade php53-odbcUpgrade php53-ldapUpgrade php53-mbstringUpgrade php53-xmlreaderUpgrade php53-bcmathUpgrade php5-pdoUpgrade php53-socketsUpgrade php53-gdUpgrade php5-calendarUpgrade php5-gettextUpgrade php53-posixUpgrade php53-zlibUpgrade php53-bz2Upgrade php53-snmpUpgrade php5-zipUpgrade php53-tidyUpgrade php5-mysqlUpgrade php5-fastcgiUpgrade php5-odbcUpgrade php5Upgrade php5-xmlreaderUpgrade php5-gmpUpgrade php53-curlUpgrade php53-suhosinUpgrade php53-zipUpgrade php53-mcryptUpgrade php53-pearUpgrade php53-imapUpgrade php53-ctypeUpgrade php5-opensslUpgrade php53-gettextUpgrade php5-ftpUpgrade php53-calendarUpgrade php5-bz2Upgrade php5-xmlwriterUpgrade php53-readlineUpgrade php53-shmopUpgrade php53-sysvshmUpgrade php53-pgsqlUpgrade php53-pdoUpgrade php53-sqliteUpgrade php5-mcrypt | Apr 26, 2018 | Jan 18, 2011 |
| Ubuntu | — | Upgrade php5-gdUpgrade php5-cgiUpgrade php5-intlUpgrade php5-commonUpgrade php5-cliUpgrade php5-curlUpgrade libapache2-mod-php5Upgrade php5-devUpgrade php5Upgrade php-pear | Nov 8, 2024 | Jan 18, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub