CVE-2026-7260: Stack overflow in phar with circular symlinks
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.
Other sources
Fixed (Crash via recursive symlinks). (CVE-2026-7260)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.33 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.33 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.33 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.24 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7260?
CVE-2026-7260 has a risk rating of 26, indicating a high severity vulnerability.
How do I fix CVE-2026-7260?
To fix CVE-2026-7260, upgrade PHP to version 8.2.33 or later, 8.3.33 or later, 8.4.24 or later, or 8.5.9 or later.
What causes CVE-2026-7260?
CVE-2026-7260 is caused by circular symbolic links in phar archives leading to unbounded recursion.
Which PHP versions are affected by CVE-2026-7260?
PHP versions from 8.2.* before 8.2.33, 8.3.* before 8.3.33, 8.4.* before 8.4.24, and 8.5.* before 8.5.9 are affected.
What impact does CVE-2026-7260 have on PHP applications?
CVE-2026-7260 can cause the PHP process to crash due to exhaustion of the C stack.