CVE-2024-8926

8.8 highEPSS 3.7%

High (8.8) in php php. EPSS 3.7% chance of exploitation in the next 30 days.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2024-10-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq
https://security.netapp.com/advisory/ntap-20241101-0003/

Check your stack JSON