The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Note | — | Apply OS X security update 2012-004Upgrade macOS to the latest version | Aug 28, 2015 | May 23, 2012 |
| Apple Osx Php | — | Apply OS X security update 2012-004Upgrade macOS to the latest version | Sep 27, 2012 | May 23, 2012 |
| Centos_linux | — | Upgrade php53-pgsqlUpgrade php-dbaUpgrade php53-ldapUpgrade php53-dbaUpgrade php53-mysqlUpgrade php-commonUpgrade php-odbcUpgrade php53-pdoUpgrade php53-bcmathUpgrade php53-processUpgrade php-intlUpgrade php-mysqlUpgrade php53-pspellUpgrade php-ldapUpgrade php53-xmlrpcUpgrade php-pdoUpgrade php-ncursesUpgrade php-soapUpgrade php-pgsqlUpgrade php53-odbcUpgrade php53-cliUpgrade phpUpgrade php-embeddedUpgrade php-cliUpgrade php-tidyUpgrade php53-imapUpgrade php-ztsUpgrade php53-gdUpgrade php-xmlUpgrade php53Upgrade php53-commonUpgrade php53-intlUpgrade php-gdUpgrade php53-develUpgrade php-mbstringUpgrade php-enchantUpgrade php-pspellUpgrade php-imapUpgrade php-xmlrpcUpgrade php-snmpUpgrade php53-soapUpgrade php53-snmpUpgrade php53-mbstringUpgrade php-processUpgrade php53-xmlUpgrade php-develUpgrade php-recodeUpgrade php-bcmath | Dec 1, 2016 | May 23, 2012 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 7, 2013 |
| Freebsd | — | Upgrade php53Upgrade php5 | Dec 10, 2025 | Apr 28, 2012 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | May 23, 2012 |
| Hpux | — | Update hpuxwsAPACHE.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.PHP to the latest versionUpdate hpuxwsAPACHE.MOD_JK to the latest versionUpdate hpuxws22APACHE.MOD_JK to the latest versionUpdate hpuxws22APACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP to the latest versionUpdate hpuxws22APCH32.PHP2 to the latest versionUpdate hpuxws22APACHE.WEBPROXY to the latest versionUpdate hpuxws22APCH32.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.PHP2 to the latest versionUpdate hpuxws22APCH32.PHP to the latest versionUpdate hpuxws22APACHE.MOD_PERL to the latest versionUpdate hpuxws22APACHE.MOD_JK2 to the latest versionUpdate hpuxws22APCH32.APACHE to the latest versionUpdate hpuxwsAPACHE.APACHE to the latest versionUpdate hpuxws22APCH32.MOD_JK to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP2 to the latest versionUpdate hpuxws22APCH32.WEBPROXY to the latest versionUpdate hpuxws22APACHE.APACHE2 to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPACHE.MOD_JK2 to the latest versionUpdate hpuxwsAPACHE.APACHE2 to the latest versionUpdate hpuxwsAPACHE.WEBPROXY to the latest versionUpdate hpuxws22APCH32.APACHE2 to the latest versionUpdate hpuxws22APCH32.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP2 to the latest versionUpdate hpuxws22APACHE.PHP to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP to the latest versionUpdate hpuxws22APACHE.APACHE to the latest versionUpdate hpuxws22APCH32.WEBPROXY2 to the latest versionUpdate hpuxws22APCH32.MOD_JK2 to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP to the latest versionUpdate hpuxws22APACHE.PHP2 to the latest versionUpdate hpuxws22APACHE.WEBPROXY2 to the latest version | Aug 11, 2017 | May 23, 2012 |
| Oracle_linux | — | Upgrade php-processUpgrade php-ztsUpgrade php-imapUpgrade php-recodeUpgrade php-gdUpgrade php-xmlUpgrade phpUpgrade php53-snmpUpgrade php53-odbcUpgrade php53-pdoUpgrade php-snmpUpgrade php53-soapUpgrade php53-mbstringUpgrade php53-cliUpgrade php53-processUpgrade php-tidyUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php53-gdUpgrade php53-commonUpgrade php-bcmathUpgrade php-cliUpgrade php53Upgrade php-enchantUpgrade php53-intlUpgrade php-pgsqlUpgrade php-odbcUpgrade php53-ldapUpgrade php53-dbaUpgrade php-develUpgrade php53-bcmathUpgrade php-commonUpgrade php53-xmlrpcUpgrade php-pdoUpgrade php-mysqlUpgrade php53-xmlUpgrade php-dbaUpgrade php53-mysqlUpgrade php-soapUpgrade php53-develUpgrade php53-imapUpgrade php-intlUpgrade php-mbstringUpgrade php53-pgsqlUpgrade php-ncursesUpgrade php53-pspellUpgrade php-pspellUpgrade php-ldap | Oct 16, 2024 | May 24, 2012 |
| Php | — | Upgrade to PHP version 5.3.11 | Jul 17, 2012 | May 24, 2012 |
| Suse | — | Upgrade php53-readlineUpgrade php53-xmlreaderUpgrade php53-bz2Upgrade php53-gmpUpgrade php53-posixUpgrade php53-develUpgrade php53-gdUpgrade php53-pgsqlUpgrade php53-gettextUpgrade php53-wddxUpgrade php53-suhosinUpgrade php53-mbstringUpgrade php53-xmlwriterUpgrade php53-pcntlUpgrade php53-calendarUpgrade php53-tidyUpgrade php53-sysvshmUpgrade php53-mysqlUpgrade php53-fastcgiUpgrade php53Upgrade php53-curlUpgrade php53-bcmathUpgrade php53-soapUpgrade php53-pdoUpgrade php53-socketsUpgrade php53-iconvUpgrade php53-odbcUpgrade php53-imapUpgrade php53-sysvmsgUpgrade php53-zipUpgrade php53-shmopUpgrade php53-ftpUpgrade php53-sysvsemUpgrade php53-pspellUpgrade php53-opensslUpgrade php53-snmpUpgrade php53-zlibUpgrade php53-fileinfoUpgrade php53-tokenizerUpgrade php53-intlUpgrade php53-xslUpgrade php53-mcryptUpgrade php53-ctypeUpgrade php53-sqliteUpgrade php53-xmlrpcUpgrade php53-domUpgrade php53-pearUpgrade php53-ldapUpgrade apache2-mod_php53Upgrade php53-jsonUpgrade php53-dbaUpgrade php53-exif | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade php5 | Nov 8, 2024 | May 24, 2012 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub