PT-2021-6877 · Php+9 · Php+9

Rawataman6525

·

Published

2021-11-20

·

Updated

2025-08-11

·

CVE-2021-21707

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions PHP versions 7.3.x through 7.3.32 PHP versions 7.4.x through 7.4.25 PHP versions 8.0.x through 8.0.12
Description The issue is related to certain XML parsing functions in PHP, such as simplexml load file(), which URL-decode the filename passed to them. If the filename contains a URL-encoded NUL character, this may cause the function to interpret it as the end of the filename, leading to the function reading a different file than intended. This could allow a remote attacker to gain unauthorized access to protected information.
Recommendations For PHP versions 7.3.x through 7.3.32, update to version 7.3.33 or later. For PHP versions 7.4.x through 7.4.25, update to version 7.4.26 or later. For PHP versions 8.0.x through 8.0.12, update to version 8.0.13 or later. As a temporary workaround, consider avoiding the use of URL-encoded NUL characters in filenames passed to simplexml load file() and other affected XML parsing functions.

Exploit

Fix

RCE

Weakness Enumeration

Related Identifiers

ALSA-2022:7628
ALT-PU-2021-3313
ALT-PU-2021-3314
ALT-PU-2021-3395
ALT-PU-2021-3416
ALT-PU-2021-3432
ALT-PU-2021-3645
BDU:2022-02394
BIT-LIBPHP-2021-21707
BIT-PHP-2021-21707
BIT-PHP-MIN-2021-21707
CESA-2022_7628
CVE-2021-21707
DLA-3243-1
DSA-5082-1
MGASA-2021-0519
OESA-2021-1455
OPENSUSE-SU-2021:1570-1
OPENSUSE-SU-2021:3943-1
OPENSUSE-SU-2021_1570-1
OPENSUSE-SU-2021_3943-1
OPENSUSE-SU-2022_0679-1
OPENSUSE-SU-2022_2292-1
OPENSUSE-SU-2022_2303-1
OPENSUSE-SU-2022_3997-1
OPENSUSE-SU-2022_4067-1
OPENSUSE-SU-2022_4069-1
OPENSUSE-SU-2024:11638-1
OPENSUSE-SU-2024:11640-1
RHSA-2022:5491
RHSA-2022:7628
RHSA-2022_7628
RLSA-2022:7628
SUSE-SU-2021:3927-1
SUSE-SU-2021:3943-1
SUSE-SU-2021_3927-1
SUSE-SU-2022:0577-1
SUSE-SU-2022:0679-1
SUSE-SU-2022:2292-1
SUSE-SU-2022:2303-1
SUSE-SU-2022:3997-1
SUSE-SU-2022:4067-1
SUSE-SU-2022:4068-1
SUSE-SU-2022:4069-1
USN-5300-1
USN-5300-2
USN-5300-3

Affected Products

Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Php
Red Hat
Rocky Linux
Suse
Ubuntu