CVE-2026-17545

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

A Denial of Service (DoS) vulnerability (CVE-2026-17545) has been identified in PHP's filesystem and stream path handling on Windows, which allows an attacker who can choose a file name that an application opens to make PHP open a device such as CON, NUL or COM1 instead of a regular file, which can block or hang the request and exhaust worker processes. PHP tracks this issue as GHSA-9f67-6fw4-hpfp.

Per MITRE CWE-67: The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

This issue affects all versions of PHP before 8.2.34, PHP 8.3 before 8.3.35, PHP 8.4 before 8.4.26 and PHP 8.5 before 8.5.11, when PHP runs on Windows.

Details

Module Info

• Product: PHP
• Affected packages: php-src (Zend/zend_virtual_cwd.c, win32/ioutil.c)
• Affected versions: <8.2.34, >=8.3.0 <8.3.35, >=8.4.0 <8.4.26, >=8.5.0 <8.5.11 (Windows only)
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11
  • NES for PHP 5.6.2 (based on PHP 5.6.40)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in all PHP versions before 8.2.34, PHP 8.3 before 8.3.35, 8.4 before 8.4.26 and 8.5 before 8.5.11 on Windows, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 6.9 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H).

Windows reserves a set of names for devices: CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$. When one of them appears as a component of a path, for example uploads\CON or cache\NUL.txt, Windows opens the device rather than a file with that name. PHP's filesystem and stream functions did not reject such names, so an attacker-chosen file name reached CreateFileW() and opened a device instead of the regular file the application expected.

Reading from or writing to a device such as the console or a serial port can block the request indefinitely. An attacker who can repeat this can tie up every PHP worker and make the application unavailable, which is how the CVE record describes the impact.

Exploitation needs PHP running on Windows and an application that builds a file path from attacker-controlled input, such as an upload name, a cache key or a template name, and then opens it. PHP on Linux and other platforms is not affected; every line the fix changes is Windows-specific code.

The fix classifies each path before it is resolved: a reserved device name used as a path component is refused with an invalid-name error, while a bare device name such as NUL and explicit device paths such as \\.\COM1 keep working for compatibility. In PHP 8.2.34, virtual_file_ex() now starts with:

#ifdef ZEND_WIN32
    switch (php_win32_ioutil_path_kind_a(path, path_length)) {
        case PHP_WIN32_IOUTIL_PATH_RESERVED:
            SET_ERRNO_FROM_WIN32_CODE(ERROR_INVALID_NAME);
            return 1;
        case PHP_WIN32_IOUTIL_PATH_DEVICE:
            memcpy(resolved_path, path, path_length + 1);
            goto verify;
        default:
            break;
    }
#endif 

PHP 5.6 has no win32/ioutil.c, so the NES for PHP 5.6 fix makes virtual_file_ex() itself refuse a reserved device name used as a path component, with the same exceptions for bare device names and \\.\ paths. HeroDevs' analysis notes that PHP 5.6 routes every file operation through virtual_file_ex() only in thread-safe builds, which is how the NES for PHP 5.6 Windows package is built.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Crispr (finder)
• OSTIF-Derek (finder)
• Shivam Mathur (remediation)