CVE-2026-17545
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
67
Improper Handling of Windows Device Names
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Confidentiality
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Read Application Data
Other
Applicable Platforms
All platforms may be affected
https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp