Live › vulnerability › CVE-2024-4577
Go to dashboardPHP on Windows running in CGI mode mishandles command-line arguments, letting a remote request inject OS commands. An attacker gets arbitrary code execution on the web server with the privileges of the PHP process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PHP Group PHP | vendor | – | – |
| php | vendor | >= 8.1.0, < 8.1.29 | 8.1.29 |
| php | vendor | >= 8.2.0, < 8.2.20 | 8.2.20 |
| php | vendor | >= 8.3.0, < 8.3.8 | 8.3.8 |
| fedoraproject fedora | vendor | = 39 | – |
| fedoraproject fedora | vendor | = 40 | – |
Check whether PHP runs as CGI on Windows: run php -v and look for the CGI binary (php-cgi.exe) serving requests in IIS or Apache configuration.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
This page as .md · .json · in your agent: get_signal("CVE-2024-4577")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.