CVE-2021-21707: Special characters break path parsing in XML functions
Fixed bug (special character is breaking the path in xml function). (CVE-2021-21707)
Other sources
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexmlloadfile(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
— Launchpad
Special characters break path parsing in XML functions
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2021-21707.
What is the severity level of CVE-2021-21707?
The severity level of CVE-2021-21707 is medium with a severity value of 5.3.
Which versions of PHP are affected by CVE-2021-21707?
PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13 are affected by CVE-2021-21707.
How does CVE-2021-21707 impact the affected software?
CVE-2021-21707 can cause certain XML parsing functions in PHP to interpret an URL-encoded NUL character as the end of the filename, potentially leading to file path manipulation.
Where can I find more information about CVE-2021-21707?
More information about CVE-2021-21707 can be found at the following references: [Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21707), [Ubuntu Security Notices - USN-5300-1](https://ubuntu.com/security/notices/USN-5300-1), [Ubuntu Security Notices - USN-5300-2](https://ubuntu.com/security/notices/USN-5300-2).