CVE-2026-7260

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its phar extension reads and writes PHP archives, including archives in tar format, and lets scripts open the files inside them through the phar:// stream wrapper.

A Denial of Service (DoS) vulnerability (CVE-2026-7260) has been identified in the symbolic link handling of PHP's phar extension, which allows an attacker who supplies a tar or phar archive whose symbolic links form a cycle to make PHP follow the links without limit until it exhausts the C stack and crashes. PHP tracks this issue as GHSA-vc5h-9ppw-p5f3.

Per MITRE CWE-674: The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

This issue affects all versions of PHP before 8.2.33, PHP 8.3 before 8.3.33, PHP 8.4 before 8.4.24 and PHP 8.5 before 8.5.9, including the End-of-Life release lines PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 through their final releases.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/phar)
• Affected versions: <8.2.33, >=8.3.0 <8.3.33, >=8.4.0 <8.4.24, >=8.5.0 <8.5.9
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.33, 8.3.33, 8.4.24, 8.5.9
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the phar extension of PHP before 8.2.33, 8.3 before 8.3.33, 8.4 before 8.4.24 and 8.5 before 8.5.9. The CVE record does not list the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, but they carry the same code and never received the upstream fix. The PHP project scores it 5.4 under CVSS 4.0 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U) and classifies it as CWE-121, Stack-based Buffer Overflow.

Tar-based phar archives can contain symbolic links, entries that point to another entry in the same archive. When PHP reads a linked entry, phar_get_link_source() looks up the target and, if the target is itself a link, calls itself again. In PHP 7.4.33 the function reads:

link = phar_get_link_location(entry);
if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) ||
    NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) {
    if (link != entry->link) {
        efree(link);
    }
    return phar_get_link_source(link_entry);
} else { 

Nothing limits the depth of this recursion or detects a link that leads back to an entry already visited. An archive in which link A points to B and B points back to A makes the function call itself until the C stack is exhausted, and the PHP process crashes. Each request that opens such an archive can take down the worker process that handles it.

Exploitation needs an application that opens a tar or phar archive the attacker supplies, for example with new Phar(), Phar::loadPhar() or a phar:// path, and reads a symlinked entry. The phar extension is built by default, and this applies to any SAPI. Applications that never open archives from untrusted sources are not exposed.

The fix follows the link chain in a loop instead of by recursion and uses Floyd's cycle detection algorithm, so a circular chain resolves to no entry instead of crashing:

slow = fast = entry;
while (1) {
    fast = phar_follow_one_link(fast);
    if (!fast || !fast->link) {
        return fast;
    }
    fast = phar_follow_one_link(fast);
    if (!fast || !fast->link) {
        return fast;
    }

    /* no need to check slow as it's always behind */
    slow = phar_follow_one_link(slow);

    if (slow == fast) {
        /* circular symlink chain */
        return NULL;
    }
} 

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.33, 8.3.33, 8.4.24, 8.5.9, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Calvin Young (eWalker Consulting) (finder)
• Enoch Chow (Isomorph Cyber) (finder)
• Jakub Zelenka (remediation)