In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-mysqlndUpgrade php-pecl-rrdUpgrade php-opcacheUpgrade php-cliUpgrade php-ldapUpgrade apcu-panelUpgrade php-embeddedUpgrade php-processUpgrade php-odbcUpgrade libzip-develUpgrade php-dbaUpgrade phpUpgrade php-dbgUpgrade php-snmpUpgrade php-commonUpgrade php-intlUpgrade libzip-toolsUpgrade php-ffiUpgrade libzipUpgrade php-mbstringUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-bcmathUpgrade php-pdoUpgrade php-enchantUpgrade php-xmlUpgrade php-pecl-apcuUpgrade php-jsonUpgrade php-gdUpgrade php-pearUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-pgsqlUpgrade php-develUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3 | Dec 19, 2024 | Oct 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade phpUpgrade php-gdUpgrade php-pdoUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-dbaUpgrade php-pspellUpgrade php-enchantUpgrade php-develUpgrade php-gmpUpgrade php-opcacheUpgrade php-soapUpgrade php-processUpgrade php-embeddedUpgrade php-cliUpgrade php-dbgUpgrade php-snmpUpgrade php-debuginfoUpgrade php-xmlUpgrade php-fpmUpgrade php-commonUpgrade php-mbstringUpgrade php-sodiumUpgrade php-odbcUpgrade php-pgsqlUpgrade php-ldapUpgrade php-intl | Feb 26, 2025 | Oct 8, 2024 |
| Amazon_linux_2023 | — | Upgrade php8.2-debugsourceUpgrade php8.2-mbstringUpgrade php8.1-odbc-debuginfoUpgrade php8.3-sodiumUpgrade php8.2-develUpgrade php8.2-embeddedUpgrade php8.3-soapUpgrade php8.1-ffi-debuginfoUpgrade php8.3-intl-debuginfoUpgrade php8.1-ldap-debuginfoUpgrade php8.3-commonUpgrade php8.2Upgrade php8.1-snmpUpgrade php8.2-intlUpgrade php8.1-opcache-debuginfoUpgrade php8.1-bcmathUpgrade php8.1-gmp-debuginfoUpgrade php8.1-tidyUpgrade php8.2-intl-debuginfoUpgrade php8.2-opcacheUpgrade php8.1-ldapUpgrade php8.2-cliUpgrade php8.3-snmpUpgrade php8.2-tidyUpgrade php8.2-zipUpgrade php8.3-develUpgrade php8.2-zip-debuginfoUpgrade php8.3-ffiUpgrade php8.2-pgsqlUpgrade php8.2-xmlUpgrade php8.3-cli-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.1-gdUpgrade php8.1-fpmUpgrade php8.1-pgsqlUpgrade php8.2-sodium-debuginfoUpgrade php8.1-intl-debuginfoUpgrade php8.3-odbc-debuginfoUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-tidy-debuginfoUpgrade php8.1-opcacheUpgrade php8.3-pdoUpgrade php8.3-debugsourceUpgrade php8.3-enchantUpgrade php8.2-tidy-debuginfoUpgrade php8.3-ldapUpgrade php8.2-gmp-debuginfoUpgrade php8.2-ldap-debuginfoUpgrade php8.1-soap-debuginfoUpgrade php8.3-odbcUpgrade php8.2-commonUpgrade php8.2-enchantUpgrade php8.3-sodium-debuginfoUpgrade php8.2-gd-debuginfoUpgrade php8.2-gmpUpgrade php8.3-opcacheUpgrade php8.1-embedded-debuginfoUpgrade php8.3-dba-debuginfoUpgrade php8.3-zip-debuginfoUpgrade php8.1-odbcUpgrade php8.3-process-debuginfoUpgrade php8.1-commonUpgrade php8.3-fpmUpgrade php8.2-snmpUpgrade php8.1-ffiUpgrade php8.2-dbaUpgrade php8.2-soap-debuginfoUpgrade php8.2-odbcUpgrade php8.2-pspellUpgrade php8.1-process-debuginfoUpgrade php8.1-zipUpgrade php8.2-opcache-debuginfoUpgrade php8.1-snmp-debuginfoUpgrade php8.3-common-debuginfoUpgrade php8.1-common-debuginfoUpgrade php8.1-processUpgrade php8.3-pdo-debuginfoUpgrade php8.2-fpm-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.2-pspell-debuginfoUpgrade php8.2-pdo-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.3-intlUpgrade php8.3-bcmathUpgrade php8.3-xmlUpgrade php8.2-sodiumUpgrade php8.2-processUpgrade php8.1-pgsql-debuginfoUpgrade php8.3-ffi-debuginfoUpgrade php8.1-intlUpgrade php8.3-mbstringUpgrade php8.1-debugsourceUpgrade php8.2-xml-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.1-xml-debuginfoUpgrade php8.3-dbgUpgrade php8.1-soapUpgrade php8.1-mysqlndUpgrade php8.1-fpm-debuginfoUpgrade php8.1-dbaUpgrade php8.3-zipUpgrade php8.3-processUpgrade php8.3-mbstring-debuginfoUpgrade php8.3-gd-debuginfoUpgrade php8.2-gdUpgrade php8.1-dbg-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.1-pdoUpgrade php8.2-soapUpgrade php8.3-embedded-debuginfoUpgrade php8.2-ffiUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.1-gd-debuginfoUpgrade php8.3Upgrade php8.3-enchant-debuginfoUpgrade php8.3-pgsql-debuginfoUpgrade php8.1-dbgUpgrade php8.1-pdo-debuginfoUpgrade php8.1-mbstring-debuginfoUpgrade php8.1-debuginfoUpgrade php8.1-tidy-debuginfoUpgrade php8.1-embeddedUpgrade php8.3-dbg-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.2-dbgUpgrade php8.1-develUpgrade php8.1Upgrade php8.2-cli-debuginfoUpgrade php8.3-gmpUpgrade php8.1-xmlUpgrade php8.1-enchant-debuginfoUpgrade php8.3-pspellUpgrade php8.2-ldapUpgrade php8.1-zip-debuginfoUpgrade php8.1-mbstringUpgrade php8.3-pgsqlUpgrade php8.3-debuginfoUpgrade php8.2-snmp-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.2-bcmathUpgrade php8.1-pspell-debuginfoUpgrade php8.1-gmpUpgrade php8.1-bcmath-debuginfoUpgrade php8.3-modphpUpgrade php8.3-pspell-debuginfoUpgrade php8.3-embeddedUpgrade php8.3-dbaUpgrade php8.2-mysqlndUpgrade php8.3-fpm-debuginfoUpgrade php8.1-pspellUpgrade php8.2-enchant-debuginfoUpgrade php8.1-enchantUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-fpmUpgrade php8.3-xml-debuginfoUpgrade php8.3-tidyUpgrade php8.2-embedded-debuginfoUpgrade php8.3-gdUpgrade php8.3-snmp-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.1-cli-debuginfoUpgrade php8.2-pdoUpgrade php8.3-cliUpgrade php8.1-dba-debuginfoUpgrade php8.3-ldap-debuginfoUpgrade php8.1-cliUpgrade php8.3-opcache-debuginfo | Feb 26, 2025 | Oct 7, 2024 |
| Debian | — | Upgrade php8.2Upgrade php7.4 | Oct 4, 2024 | Oct 4, 2024 |
| Freebsd | — | Upgrade php83Upgrade php82Upgrade php81 | Dec 10, 2025 | Sep 30, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Jan 24, 2025 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade php-pearUpgrade php-develUpgrade phpUpgrade php-commonUpgrade php-ldapUpgrade php-xmlUpgrade php-mbstringUpgrade php-snmpUpgrade php-pecl-xdebug3Upgrade libzip-develUpgrade php-mysqlndUpgrade php-pecl-xdebugUpgrade php-dbgUpgrade php-opcacheUpgrade php-cliUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-ffiUpgrade php-gdUpgrade apcu-panelUpgrade php-soapUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-pecl-zipUpgrade php-pdoUpgrade php-intlUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-pecl-apcu-develUpgrade php-enchantUpgrade libzipUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-dbaUpgrade php-process | Dec 12, 2024 | Oct 7, 2024 |
| Redhat_linux | — | Upgrade php-bcmath-debuginfoUpgrade phpUpgrade php-json-debuginfoUpgrade php-ffiUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-process-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebug-debugsourceUpgrade libzipUpgrade php-ffi-debuginfoUpgrade php-odbcNo solution existsUpgrade php-dbgUpgrade php-debuginfoUpgrade apcu-panelUpgrade libzip-debugsourceUpgrade php-gd-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldap-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zipUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-pgsqlUpgrade php-odbc-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade libzip-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-ldapUpgrade php-gmp-debuginfoUpgrade php-commonUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-common-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrdUpgrade php-mysqlndUpgrade php-develUpgrade php-intl-debuginfoUpgrade php-pearUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug3Upgrade php-pecl-zip-debugsourceUpgrade php-gmpUpgrade php-processUpgrade php-pecl-apcu-debuginfoUpgrade php-jsonUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gdUpgrade php-snmp-debuginfoUpgrade php-snmpUpgrade php-embeddedUpgrade php-cliUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade php-mbstringUpgrade php-debugsourceUpgrade php-xmlrpcUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xmlUpgrade php-pdoUpgrade php-dbg-debuginfoUpgrade php-enchantUpgrade php-fpmUpgrade libzip-develUpgrade php-pecl-xdebug | Feb 10, 2025 | Oct 8, 2024 |
| Rocky_linux | — | Upgrade php-mysqlndUpgrade php-soap-debuginfoUpgrade php-json-debuginfoUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade libzip-debuginfoUpgrade libzip-develUpgrade php-gdUpgrade libzip-toolsUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade libzipUpgrade php-bcmathUpgrade php-bcmath-debuginfoUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pecl-rrd-debugsourceUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-gmp-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-enchantUpgrade php-ffiUpgrade libzip-debugsourceUpgrade php-gd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-ldapUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-intlUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-pgsql-debuginfoUpgrade php-dbaUpgrade php-snmpUpgrade phpUpgrade php-opcache-debuginfoUpgrade php-pecl-rrdUpgrade php-xml-debuginfoUpgrade php-soapUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-jsonUpgrade php-snmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-common-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-mbstringUpgrade php-dba-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-odbc-debuginfoUpgrade php-gmpUpgrade php-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-processUpgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebug | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade php7-sysvsemUpgrade php74-ctypeUpgrade php7-posixUpgrade php8-xmlreaderUpgrade php74-develUpgrade php7-tidyUpgrade php74-pgsqlUpgrade php74-shmopUpgrade php74-fpmUpgrade php74-sqliteUpgrade php8-gmpUpgrade php7-cliUpgrade php7-ctypeUpgrade php74-ldapUpgrade php74-mysqlUpgrade php8-sodiumUpgrade php7-calendarUpgrade apache2-mod_php74Upgrade php74-odbcUpgrade php8-dbaUpgrade php7-xmlreaderUpgrade php8-develUpgrade php7-odbcUpgrade php8-soapUpgrade php74-tidyUpgrade php74-socketsUpgrade php7-xslUpgrade php8-calendarUpgrade php74-zipUpgrade php74-enchantUpgrade php74-soapUpgrade php7-gdUpgrade php7-curlUpgrade php8-zipUpgrade php8-sysvmsgUpgrade php8-opcacheUpgrade php74-tokenizerUpgrade php7-sqliteUpgrade php7-opcacheUpgrade php7-mysqlUpgrade php8-zlibUpgrade php7-xmlrpcUpgrade php8-domUpgrade php8-bz2Upgrade php7-socketsUpgrade php8-gdUpgrade php74-sodiumUpgrade php74-fileinfoUpgrade php74-iconvUpgrade php8-xmlwriterUpgrade php7-zipUpgrade php7-domUpgrade php7-sodiumUpgrade php8-embedUpgrade php8-ctypeUpgrade php74-gmpUpgrade php74-curlUpgrade php7-fileinfoUpgrade php8-tokenizerUpgrade php8-ldapUpgrade php7-bz2Upgrade php7-gmpUpgrade php8-xslUpgrade php8-opensslUpgrade php8-odbcUpgrade php8-mysqlUpgrade php7-testUpgrade php8-socketsUpgrade php74-xmlreaderUpgrade php74-gdUpgrade php8-testUpgrade php8-cliUpgrade php8-enchantUpgrade php8Upgrade php74-zlibUpgrade php74-opcacheUpgrade php74-bcmathUpgrade php7-readlineUpgrade php7-pdoUpgrade php8-fpm-apacheUpgrade php8-intlUpgrade php7-intlUpgrade php8-pdoUpgrade php74-snmpUpgrade php74-pcntlUpgrade php74-bz2Upgrade php7-sysvshmUpgrade php74-opensslUpgrade php8-sqliteUpgrade php8-sysvshmUpgrade php7-tokenizerUpgrade php7-exifUpgrade php8-curlUpgrade php7-iconvUpgrade php8-pharUpgrade apache2-mod_php7Upgrade php7-gettextUpgrade php7-soap | Dec 31, 2024 | Oct 8, 2024 |
| Ubuntu | — | Upgrade php7.2-fpm (Ubuntu Pro)Upgrade libapache2-mod-php7.4Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.0-cli (Ubuntu Pro)Upgrade php7.4-cliUpgrade php7.4-fpmUpgrade php8.3-fpmUpgrade php5-cgi (Ubuntu Pro)Upgrade php5 (Ubuntu Pro)Upgrade php7.2-cli (Ubuntu Pro)Upgrade php8.1-cgiUpgrade php5-cli (Ubuntu Pro)Upgrade php8.1-fpmUpgrade php5-fpm (Ubuntu Pro)Upgrade php8.3-cliUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro)Upgrade libapache2-mod-php8.3Upgrade php8.1-cliUpgrade php7.4-cgiUpgrade php7.2-cgi (Ubuntu Pro)Upgrade php8.3-cgiUpgrade libapache2-mod-php7.2 (Ubuntu Pro)Upgrade libapache2-mod-php8.1Upgrade libapache2-mod-php7.0 (Ubuntu Pro) | Oct 2, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub