Skip to content
OpenAdvisories

Package · Wolfi

php-8.1

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2024-8927

    cgi.force_redirect configuration is bypassable due to the environment variable collision

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be control…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.7
    CVE-2024-5585 EPSS 29%

    Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping,…

    PHP Group PHP php php83 Azure Linux Alpine Wolfi