Skip to content
fr Sign in
8.1 High

CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard…

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Affected products and versions

Product Affected versions Fixed in
PHP 8.3 earliest → < 8.3.12 8.3.12
PHP 8.2 earliest → < 8.2.24 8.2.24
PHP 8.1 earliest → < 8.1.30 8.1.30
PHP 8.3 8.3.0 → < 8.3.12 8.3.12
PHP 8.2 8.2.0 → < 8.2.24 8.2.24
PHP 8.1 8.1.0 → < 8.1.30 8.1.30

References

Timeline

  1. Published
  2. Last modified

Other CVEs of PHP

The 103 CVEs of PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critical CVE-2026-109618 RCE via OOM corruption 9.2 Critical CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Medium CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Medium
Track this CVE