Vulnerability · Published May 10, 2026 · Assigned by php

CVE-2026-6735XSS within PHP-FPM status endpoint

High 7.3

In plain English

A high-severity cross-site scripting in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:10php8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-bcmath8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-bcmath8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-bcmath7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-bcmath8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-bcmath8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-bcmath8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-cli8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-cli8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-cli7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-cli8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-cli8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-cli8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-common8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-common8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-common7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-common8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-common8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-common8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dba8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dba8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dba7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dba8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dba8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-dba8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dbg8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dbg8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dbg7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dbg8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dbg8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-dbg8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-devel8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-devel8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-devel7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-devel8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-devel8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-devel8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-embedded8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-embedded8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-embedded7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-embedded8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-embedded8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-embedded8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-enchant8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-enchant7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-enchant8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-enchant8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-enchant8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-enchant8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-ffi8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ffi8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-ffi7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-ffi8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ffi8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-ffi8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-fpm8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-fpm8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-fpm7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-fpm8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-fpm8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-fpm8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-gd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-gmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-intl8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-intl7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-intl8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-intl8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-intl8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-intl8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-json7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php-ldap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ldap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-ldap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-ldap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-ldap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ldap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-mbstring8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mbstring7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mbstring8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mbstring8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mbstring8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-mbstring8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-mysqlnd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mysqlnd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mysqlnd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mysqlnd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-mysqlnd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mysqlnd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-odbc8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-odbc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-odbc8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-odbc8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-odbc8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-odbc8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-opcache8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-opcache7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-opcache8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-opcache8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-opcache8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-opcache8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-pdo8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pdo7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pdo8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pdo8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-pdo8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pdo8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-redis66.1.0-2.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:10php-pgsql8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pgsql7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pgsql8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pgsql8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pgsql8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-pgsql8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-process8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-process7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-process8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-process8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-process8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-process8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-snmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-snmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-snmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-snmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-snmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-snmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-soap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-soap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-soap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-soap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-soap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-soap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-xml8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-xml8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-xml7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-xml8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-xml8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-xml8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-xmlrpc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php8.48.4.21-1.el10_2ALSA-2026:22649
AlmaLinux:10php8.4-bcmath8.4.21-1.el10_2ALSA-2026:22649

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.2.* – before 8.2.318.3.* – before 8.3.318.4.* – before 8.4.218.5.* – before 8.5.6

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber

References