← Database

CVE-2008-0599

CRITICAL CVSS: 9.8 Published: 2008-05-05 Modified: 2026-06-16

Description

The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

Affected Platforms

Canonical Ubuntu LinuxFedoraproject FedoraApple Mac Os XPhp PhpApple Mac Os X Server

Weakness Type

CWE-131

References