CVE-2019-11044
LowCVSS 3.7Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, the link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g., in applications checking paths that the code is allowed to access.
Risk Assessment
Risk of bypassing file access controls on Windows, potentially allowing an attacker to access unauthorized paths or files.
Recommendation
Upgrade PHP to version 7.2.26 or later, 7.3.13 or later, or 7.4.1 or later.
Original NVD description (English source)
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.