CVE-2026-17545
Publication date 25 September 2026
Last updated 7 October 2026
Ubuntu priority
Description
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| php5 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 14.04 LTS trusty | Ignored windows only | |
| php7.0 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial | Ignored windows only | |
| php7.2 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic | Ignored windows only | |
| php7.4 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Ignored windows only | |
| php8.1 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Ignored windows only | |
| php8.3 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Ignored windows only | |
| 22.04 LTS jammy | Not in release | |
| php8.5 | 26.04 LTS resolute | Ignored windows only |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Notes
sbeattie
PEAR issues should go against php-pear as of xenial PEAR issues should go against php-pear as of xenial
igcontreras
This CVE affects windows only
Severity score breakdown
CVSS version: CVSS v4.0
Base score
6.9 · Medium
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H