9.8
Critical
Exploited
· ransomware
CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Known to be used
Weakness
CWE-78
Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Affected products and versions
References
- github.com github.com
- blog.orange.tw blog.orange.tw
- devco.re devco.re
- arstechnica.com arstechnica.com
- www.imperva.com www.imperva.com
- github.com github.com
- github.com github.com
- github.com github.com
- labs.watchtowr.com labs.watchtowr.com
- github.com github.com
- www.php.net www.php.net
- www.php.net www.php.net
- www.php.net www.php.net
- cert.be cert.be
- isc.sans.edu isc.sans.edu
- www.openwall.com www.openwall.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium