CVE-2019-11045
LowCVSS 3.7Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, the DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g., in applications checking paths that the code is allowed to access.
Risk Assessment
Risk of bypassing file access controls, potentially allowing an attacker to access unauthorized paths or files.
Recommendation
Upgrade PHP to version 7.2.26 or later, 7.3.13 or later, or 7.4.1 or later.
Original NVD description (English source)
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.