Special characters break path parsing in XML functions
Priority MEDIUM 45CWE-159Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Why it matters now
EPSS 0.25315 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial PHP (PHP Group): 7.3.33, 7.4.26, 8.0.13Red Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHP Group | PHP | 7.3.x to before 7.3.33; 7.4.x to before 7.4.26; 8.0.X to before 8.0.13 | 7.3.33, 7.4.26, 8.0.13 | Patch available | CNA |
- PHP VendorPHP Group Affected 7.3.x to before 7.3.33; 7.4.x to before 7.4.26; 8.0.X to before 8.0.13 Fixed in 7.3.33, 7.4.26, 8.0.13 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | 7.3.0 to before 7.3.33; 7.4.0 to before 7.4.26; 8.0.0 to before 8.0.13 | Vulnerable | PHP |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | before 5.21.0 | Vulnerable | Tenable |
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.3.0 to before 7.3.33; 7.4.0 to before 7.4.26; 8.0.0 to before 8.0.13 Vulnerable ·PHP
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.21.0 Vulnerable ·Tenable
Remediation
- Fix · CNA PHP (PHP Group) Fixed in 7.3.33, 7.4.26, 8.0.13
Red Hat 2 advisories
- RHSA-2022:7628 Released 2022-11-08 · Red Hat rating Moderatephp:7.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
- RHSA-2022:5491 Released 2022-07-04 · Red Hat rating Importantrh-php73-php security and bug fix update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-php73-php-7.3.33-1.el7, rh-php73-php-bcmath-7.3.33-1.el7, rh-php73-php-cli-7.3.33-1.el7 +26
- Red Hat Software Collections for RHEL(v. 7) rh-php73-php-7.3.33-1.el7, rh-php73-php-bcmath-7.3.33-1.el7, rh-php73-php-cli-7.3.33-1.el7 +26
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7628 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:5491 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:5491 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21707
- 2026-10-03 Alias added: GHSA-qh78-qfw9-93x9
References
More PHP Group vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
- TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
- TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
Sources
- CVE-2021-21707 · CVE Program
- CVE-2021-21707 · NVD
- FIRST EPSS
- GHSA-qh78-qfw9-93x9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21707 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences