CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout
Fixed (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
Other sources
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.33 - Upgrade
Upgrade
PHP (general)to a version that resolves this vulnerability.Fixed in 8.2.33 - Upgrade
Upgrade
PHP (general)to a version that resolves this vulnerability.Fixed in 8.3.33 - Upgrade
Upgrade
PHP (general)to a version that resolves this vulnerability.Fixed in 8.4.24 - Upgrade
Upgrade
PHP (general)to a version that resolves this vulnerability.Fixed in 8.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17543?
CVE-2026-17543 has a severity score of 8.1, indicating a high risk.
How do I fix CVE-2026-17543?
To mitigate CVE-2026-17543, upgrade to PHP versions 8.2.33 or later, 8.3.33 or later, 8.4.24 or later, or 8.5.9 or later.
What type of vulnerability is CVE-2026-17543?
CVE-2026-17543 is classified as an SQL injection vulnerability.
Who is affected by CVE-2026-17543?
CVE-2026-17543 affects PHP versions 8.2.* prior to 8.2.33, 8.3.* prior to 8.3.33, 8.4.* prior to 8.4.24, and 8.5.* prior to 8.5.9.
What can attackers achieve with CVE-2026-17543?
Attackers can exploit CVE-2026-17543 to execute arbitrary SQL commands through improper escaping of backslashes.