Path traversal in Meta HHVM
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta | HHVM | 4.83.0 and later; 4.82.0 and later; 4.81.0 and later; 4.80.0 and later; 4.79.0 and later; 4.57.0 and later; before 4.56.2 | 4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2 | Patch available | CNA |
- HHVM VendorMeta Affected 4.83.0 and later; 4.82.0 and later; 4.81.0 and later; 4.80.0 and later; 4.79.0 and later; 4.57.0 and later; before 4.56.2 Fixed in 4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* | before 4.56.2; 4.57.0 – 4.78.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hhvm:4.79.0:*:*:*:*:*:*:* | 4.79.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hhvm:4.80.0:*:*:*:*:*:*:* | 4.80.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hhvm:4.81.0:*:*:*:*:*:*:* | 4.81.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hhvm:4.82.0:*:*:*:*:*:*:* | 4.82.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hhvm:4.83.0:*:*:*:*:*:*:* | 4.83.0 | Vulnerable | Meta |
- cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* Versions before 4.56.2; 4.57.0 – 4.78.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hhvm:4.79.0:*:*:*:*:*:*:* Versions 4.79.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hhvm:4.80.0:*:*:*:*:*:*:* Versions 4.80.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hhvm:4.81.0:*:*:*:*:*:*:* Versions 4.81.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hhvm:4.82.0:*:*:*:*:*:*:* Versions 4.82.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hhvm:4.83.0:*:*:*:*:*:*:* Versions 4.83.0 Vulnerable ·Meta
Remediation
- Fix · CNA HHVM (Facebook) Fixed in 4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3556
- 2026-10-03 Alias added: GHSA-36h6-q98c-7j6j
References
More Meta Hhvm vulnerabilities
- TI-2018-04659 Improper input validation in Meta HHVM CVSS 3.1CRITICAL 9.8
- TI-2022-17147 Broken or risky cryptographic algorithm in Meta HHVM CVSS 3.1CRITICAL 9.8
- TI-2019-08934 Memory corruption in Meta HHVM CVSS 3.1CRITICAL 9.8
- TI-2021-06352 Heap-based buffer overflow in Meta folly CVSS 3.1CRITICAL 9.8
- TI-2019-08935 An invalid free in mb_detect_order can cause the application to crash or potentially… CVSS 3.1CRITICAL 9.8
- TI-2016-05898 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-3556 · CVE Program
- CVE-2019-3556 · NVD
- FIRST EPSS
- GHSA-36h6-q98c-7j6j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences