PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access…

Description

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

Scores

EPSS (exploitation in 30 days)

5.4% · top 7.3% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• n/a

  • affected n/a

References (26)

• 44951 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://svn.php.net/viewvc?view=revision&revision=305412 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20101118 Re: NULL byte poisoning fix in php 5.3.4+ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• HPSBOV02763 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://www.php.net/releases/5_3_4.php (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://svn.php.net/viewvc?view=revision&revision=305507 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.madirish.net/?article=436 (opens in a new tab)x_refsource_MISCx_transferred
• 55078 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• APPLE-SA-2011-03-21-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• http://bugs.php.net/39863 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.php.net/ChangeLog-5.php (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20101118 NULL byte poisoning fix in php 5.3.4+ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2013:1307 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• MDVSA-2010:254 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• RHSA-2013:1615 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www.php.net/archive/2010.php#id2010-12-10-1 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SSRT100728 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• oval:org.mitre.oval:def:12569 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2014:0311 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• FEDORA-2015-8383 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2015-8281 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2015-8370 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://support.apple.com/kb/HT4581 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-7243](https://trackcve.app/badge/CVE-2006-7243.svg)](https://trackcve.app/cve/CVE-2006-7243)

Record last updated 7 Aug 2024, 20:57 UTC.