CVE-2026-17545
Fixed in a distro release EPSS <1%CVSS 6.9
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
Products: PHP Group PHP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat hummingbird 1 | php | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-bcmath | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-cli | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-common | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-dba | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-dbg | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-devel | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-embedded | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-enchant | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-ffi | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-fpm | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-gd | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-gmp | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-intl | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-ldap | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-mbstring | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-mysqlnd | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-odbc | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-pdo | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-pdo-dblib | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-pdo-firebird | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-pgsql | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-process | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-snmp | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-soap | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-sodium | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-tidy | 0:8.5.11-2.hum1 |
| Red Hat hummingbird 1 | php-xml | 0:8.5.11-2.hum1 |
| Ubuntu 22.04 LTS | php8.1 | no fix |
| Ubuntu 24.04 LTS | php8.3 | no fix |
| Ubuntu 26.04 LTS | php8.5 | no fix |
| Ubuntu Pro 14.04 LTS | php5 | no fix |
| Ubuntu Pro 16.04 LTS | php7.0 | no fix |
| Ubuntu Pro 18.04 LTS | php7.2 | no fix |
| Ubuntu Pro 20.04 LTS | php7.4 | no fix |
| openSUSE Tumbleweed | php8 | 8.5.11-1.1 |