In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.20, 8.3.* before 8.3.14 and 8.4.* before 8.4.14, when using php-cgi, a query string without '=' may be interpreted as command-line arguments, allowing an attacker to pass -d directives and execute arbitrary code.
ExploitedCISA KEV2026-10-24Patch available
NVD score
9.8 Critical
Weakness
CWE-94
Improper Control of Generation of Code (Code Injection)
EPSS probability
99.8th percentile
Vector string
CVSS v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected CPEs
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* (8.1.0 ≤ v < 8.1.31)
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* (8.2.0 ≤ v < 8.2.20)
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* (8.3.0 ≤ v < 8.3.14)
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* (8.4.0 ≤ v < 8.4.14)