Vulnerability · Published Oct 8, 2024 · Assigned by php
CVE-2024-8926PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
High 8.1
In plain English
A high-severity OS command injection in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | php82 | 8.2.24-r0 | ALPINE-CVE-2024-8926 |
| Alpine:v3.20 | php83 | 8.3.12-r0 | ALPINE-CVE-2024-8926 |
| Debian:12 | php8.2 | 8.2.24-1~deb12u1 | DEBIAN-CVE-2024-8926 |
| Debian:12 | php8.2 | 8.2.24-1~deb12u1 | DSA-5780-1 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H