CVE-2024-8926
High
Description
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Php
PublishedOct 8, 2024
First seenOct 8, 2024
Weakness typeCWE-78OS command injection
How to fix
Update
- php php8.1.30, 8.2.24, 8.3.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 8.1.0 ≤ v < 8.1.30, 8.2.0 ≤ v < 8.2.24, 8.3.0 ≤ v < 8.3.12 | 8.1.30, 8.2.24, 8.3.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.