Vulnerability · Published Nov 29, 2021 · Assigned by php
CVE-2021-21707Special characters break path parsing in XML functions
Medium 5.3
In plain English
A medium-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.3% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)25.3%top 2.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-bcmath | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-cli | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-common | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-dba | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-dbg | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-devel | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-embedded | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-enchant | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-ffi | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-fpm | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-gd | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-gmp | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-intl | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-json | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-ldap | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-mbstring | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-mysqlnd | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-odbc | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-opcache | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pdo | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pear | 1:1.10.13-1.module_el8.6.0+3268+b150a051 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:7628 |
| AlmaLinux:8 | php-pgsql | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-process | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-snmp | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-soap | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-xml | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux:8 | php-xmlrpc | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.6.0+789+2130c178 | RLSA-2022:7628 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux:8 | php | 0:7.4.30-1.module+el8.7.0+1067+0a7071cc | RLSA-2022:7628 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.7.0+1067+0a7071cc | RLSA-2022:7628 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.6.0+1006+0d5a469f | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.6.0+789+2130c178 | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.6.0+789+2130c178 | RLSA-2022:7628 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
Affected products (as reported)
Weakness: CWE-159 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N