DirectoryIterator class silently truncates after a null byte
At a glance
Severity
LOW 3.7
EPSS
EPSS 8.82 % · percentile 95 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
php
NVD status
Modified
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
