CVE-2026-7260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7260", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-04-28T05:07:45.654Z", "datePublished": "2026-07-30T11:22:53.918Z", "dateUpdated": "2026-07-30T12:15:22.862Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-07-30T11:22:53.918Z"}, "title": "Stack overflow in phar with circular symlinks", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "ext-phar", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,\u00a0in PHP versions\u00a0from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9."}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U"}}], "credits": [{"lang": "en", "value": "Calvin Young - eWalker Consulting (HK) Limited", "type": "finder"}, {"lang": "en", "value": "Enoch Chow - Isomorph Cyber", "type": "finder"}, {"lang": "en", "value": "Jakub Zelenka - The PHP Foundation", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T12:15:12.750948Z", "id": "CVE-2026-7260", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:15:22.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7260", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T12:15:12.750948Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:15:17.348Z"}}], "cna": {"title": "Stack overflow in phar with circular symlinks", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Calvin Young - eWalker Consulting (HK) Limited"}, {"lang": "en", "type": "finder", "value": "Enoch Chow - Isomorph Cyber"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Zelenka - The PHP Foundation"}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver"}], "packageName": "ext-phar", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,\u00a0in PHP versions\u00a0from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "supportingMedia": [{"type": "text/html", "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow"}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-07-30T11:22:53.918Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7260", "state": "PUBLISHED", "dateUpdated": "2026-07-30T12:15:22.862Z", "dateReserved": "2026-04-28T05:07:45.654Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2026-07-30T11:22:53.918Z", "assignerShortName": "php"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "ext-phar", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.2.33", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.33", "status": "affected", "version": "8.3.*", "versionType": "semver"}, {"lessThan": "8.4.24", "status": "affected", "version": "8.4.*", "versionType": "semver"}, {"lessThan": "8.5.9", "status": "affected", "version": "8.5.*", "versionType": "semver"}]}], "source": "security@php.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "62A8FE13-63F1-4275-A4B4-5680DB1133A7", "versionEndExcluding": "8.2.33", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "1969AFC1-F5C6-49B5-9AD7-458A3DAC3714", "versionEndExcluding": "8.3.33", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDD69D6E-2D22-4E79-842A-6ACCCBDA4D05", "versionEndExcluding": "8.4.24", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "88F3F6A2-3261-4108-AF45-08527AE89810", "versionEndExcluding": "8.5.9", "versionStartIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,\u00a0in PHP versions\u00a0from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9."}, {"lang": "es", "value": "Los enlaces simb\u00f3licos circulares en archivos phar podr\u00edan llevar a una recursi\u00f3n ilimitada, agotando la pila C y bloqueando el proceso PHP, en versiones de PHP desde 8.2.* antes de 8.2.33, desde 8.3.* antes de 8.3.33, desde 8.4.* antes de 8.4.24, y desde 8.5.* antes de 8.5.9."}], "id": "CVE-2026-7260", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@php.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7260", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T12:15:12.750948Z", "version": "2.0.3"}}]}, "published": "2026-07-30T12:19:04.300", "references": [{"source": "security@php.net", "tags": ["Vendor Advisory"], "url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "security@php.net", "type": "Secondary"}]}

{"bugzilla": {"description": "php: PHP: Denial of Service via circular symbolic links in phar archives", "id": "2509255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509255"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-606", "details": ["Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process,\u00a0in PHP versions\u00a0from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "A flaw was found in PHP. When processing a specially crafted PHP Archive (phar) file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow an attacker to trigger a Denial of Service (DoS) condition, making the affected PHP service unavailable."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid processing phar archives from untrusted sources. If the `phar` extension is not essential for your application, consider disabling it in the PHP configuration. Disabling the `phar` extension may impact applications that rely on it for legitimate archive handling."}, "name": "CVE-2026-7260", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.3/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "php", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-07-30T11:22:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-7260\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-7260\nhttps://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3"], "statement": "This Moderate impact flaw in PHP allows a local attacker to trigger a denial of service by providing a specially crafted phar archive containing circular symbolic links. Successful exploitation exhausts the C stack, leading to a PHP process crash, which can disrupt services utilizing PHP for archive processing.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PHP", "source": "cna", "vendor": "PHP Group"}, "product": "php", "vendor": "php_group"}], "created": "2026-07-30T12:30:05.609444+00:00", "updated": "2026-08-07T02:15:04.217205+00:00", "vendors": ["php_group", "php_group$PRODUCT$php"]}