CVE-2019-11045: DirectoryIterator class silently truncates after a null byte
A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Reference: https://bugs.php.net/bug.php?id=78863
Other sources
Fixed bug (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045)
— PHP
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-11045.
What is the severity of CVE-2019-11045?
The severity of CVE-2019-11045 is medium with a CVSS score of 5.9.
Which PHP versions are affected by CVE-2019-11045?
PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 are affected by CVE-2019-11045.
What is the impact of CVE-2019-11045?
CVE-2019-11045 could lead to security vulnerabilities in applications checking paths that the code is allowed to access.
How can I fix CVE-2019-11045?
To fix CVE-2019-11045, update PHP to version 7.2.26, 7.3.13, or 7.4.1 or later.