DEBIAN-CVE-2026-6735
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-6735
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6735.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-6735
- Upstream
- Published
- 2026-05-10T05:16:11Z
- Modified
- 2026-09-14T17:03:28Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
- References
Affected packages
Debian:12 / php8.2
Package
- Name
- php8.2
- Purl
- pkg:deb/debian/php8.2?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.2.31-1~deb12u1
Affected versions
8.*
8.2.5-2
8.2.7-1~deb12u1
8.2.7-1
8.2.7-1.1
8.2.7-1.2
8.2.10-1
8.2.10-2
8.2.12-1
8.2.16-1
8.2.16-2
8.2.17-1
8.2.18-1~deb12u1
8.2.18-1
8.2.20-1~deb12u1
8.2.20-2
8.2.20-3
8.2.21-1
8.2.23-1
8.2.24-1~deb12u1
8.2.24-1
8.2.26-1~deb12u1
8.2.26-4
8.2.27-1
8.2.28-1~deb12u1
8.2.29-1~deb12u1
8.2.30-1~deb12u1
Debian:13 / php8.4
Package
- Name
- php8.4
- Purl
- pkg:deb/debian/php8.4?arch=source&distro=trixie
Debian:14 / php8.4
Package
- Name
- php8.4
- Purl
- pkg:deb/debian/php8.4?arch=source&distro=forky