CVE-2024-8926: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Fixed bug (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
Other sources
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
— MITRE
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.12 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.30 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.24
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8926?
CVE-2024-8926 is rated as a medium severity vulnerability.
How do I fix CVE-2024-8926?
To fix CVE-2024-8926, upgrade PHP versions to 8.1.30, 8.2.24, or 8.3.12 or later.
What PHP versions are affected by CVE-2024-8926?
CVE-2024-8926 affects PHP versions 8.1.0 to 8.1.29, 8.2.0 to 8.2.23, and 8.3.0 to 8.3.11.
What type of vulnerability is CVE-2024-8926?
CVE-2024-8926 is a parameter injection vulnerability that allows bypassing a previous fix.
Is there a workaround for CVE-2024-8926?
There are no specific workarounds for CVE-2024-8926; updating to a secure version is recommended.