CVE-2026-6735
- Source
- https://cve.org/CVERecord?id=CVE-2026-6735
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6735.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-6735
- Aliases
-
- BIT-libphp-2026-6735
- BIT-php-2026-6735
- BIT-php-min-2026-6735
- GHSA-7qg2-v9fj-4mwv
- Downstream
ALPINE (1)
ALSA (7)
AZL (1)
BELL (1)
CLSA (9)
DEBIAN (1)
ECHO (1)
MGASA (1)
openSUSE (2)
RHSA (8)
RLSA (7)
SUSE (5)
UBUNTU (1)
- Related
- Published
- 2026-05-10T03:27:00Z
- Modified
- 2026-11-11T02:56:01Z
- Severity
-
- 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber CVSS Calculator
- Summary
- XSS within PHP-FPM status endpoint
- Details
-
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
- Database specific
{ "cna_assigner": "php", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6735.json" }- References
Affected packages
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.2.0" }, { "fixed": "8.2.31" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.3.0" }, { "fixed": "8.3.31" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.4.0" }, { "fixed": "8.4.21" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.5.0" }, { "fixed": "8.5.6" } ], "source": "CPE_RANGE" } ] }