CVE-2026-6735
XSS within PHP-FPM status endpoint
At a glance Severity HIGH 7.3 EPSS EPSS 0.19 % · percentile 9 (2026-10-27) State PUBLISHED Published 2026-05-10 Updated 2026-05-11 Assigner php NVD status Analyzed Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Scores Version Score Vector Scored by CVSS 4.0 HIGH 7.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber php CVSS 4.0 HIGH 7.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber NVD · security@php.net (Secondary) CVSS 3.1 MEDIUM 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.31cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.31cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.21cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.6Affected products Product Versions PHP Group · PHP affected 8.2.* < 8.2.31 ; affected 8.3.* < 8.3.31 ; affected 8.4.* < 8.4.21 ; affected 8.5.* < 8.5.6
References
Sources
