[ CVE-2026-17545 · Published 25 Sep 2026 ]
Vulnerability in PHP Group PHP
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3585
PHP: Multiple vulnerabilities Translated from German
-
CERT-FRCERTFR-2026-AVI-1227
Multiple vulnerabilities in PHP Translated from French
Multiple vulnerabilities have been discovered in PHP. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.