Description
PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.6 | RHSA-2005:406 |
| RHEL 3 | php +6 | 4.3.2-23.ent | RHSA-2005:405 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 4.x/5 - cURL 'open_basedir' Restriction Bypass EDB-24711 · remote · Oct 28, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2005:405 Red Hat Security Advisory: PHP security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:406 Red Hat Security Advisory: PHP security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- php-openbasedir-restriction-bypass(17900) vdb-entry
- RHSA-2005:406 vendor-advisory
- 11557 vdb-entry
- 20050120 [USN-66-1] PHP vulnerabilities mailing-list
- oval:org.mitre.oval:def:9279 vdb-entry signature
- FLSA:2344 vendor-advisory
- 1011984 vdb-entry
- 20041027 PHP4 cURL functions bypass open_basedir mailing-list
- RHSA-2005:405 vendor-advisory