CVE-2026-6735: XSS within PHP-FPM status endpoint
Fixed (XSS within status endpoint). (CVE-2026-6735)
Other sources
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.21-1~deb13u1Fixed in 8.4.21-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6735?
CVE-2026-6735 is considered a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-6735?
To resolve CVE-2026-6735, update your PHP version to 8.5.6 or later.
What systems are affected by CVE-2026-6735?
CVE-2026-6735 affects PHP versions up to 8.5.6.
What type of vulnerability is CVE-2026-6735?
CVE-2026-6735 is a cross-site scripting (XSS) vulnerability.
Can CVE-2026-6735 be exploited remotely?
Yes, CVE-2026-6735 can be exploited remotely if the vulnerable software is accessible over the internet.