CVE-2024-8926 PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

What is CVE-2024-8926?

CVE-2024-8926 is a high-severity command injection vulnerability in Php Php, published on 8 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Weakness: CWE-78

Which versions are affected by CVE-2024-8926?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.

Products include Php Php.

How do I fix CVE-2024-8926?

Upgrade libphp to a fixed version for your release line: 8.1.30, 8.2.24 or 8.3.12.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-8926 being exploited?

There is no known exploitation of CVE-2024-8926 in the wild and no public exploit code.

Other vulnerabilities in Php Php

• CVE-2012-2688 Integer overflow in n/a Critical 10.0
• CVE-2012-2376 Memory corruption in n/a Critical 10.0
• CVE-2011-3268 Memory corruption in n/a Critical 10.0
• CVE-2009-4143 Other in n/a Critical 10.0
• CVE-2008-5557 Memory corruption in n/a Critical 10.0

All Php Php vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-libphp-2024-8926, BIT-php-2024-8926, BIT-php-min-2024-8926, CLEANSTART-2026-YW89455, DEBIAN-CVE-2024-8926, ECHO-23f7-5807-f11c and 1 more.