datadog/dd-trace Circumvents open_basedir INI directive
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
datadog/dd-trace versions 0.30.0 prior to 0.30.2 are affected by a security and stability issue outlined in PR [#579](https://github.com/DataDog/dd-trace-php/pull/579). This pull request ensures that the ddtrace.request_init_hook remains bound by the open_basedir INI directive, effectively addressing potential vulnerabilities related to open_basedir restrictions. The update introduces a sandboxing mechanism to isolate the request init hook from errors or exceptions during execution, enhancing the library's stability and preventing adverse impacts on the main script.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | datadog/dd-trace (Packagist) | 0.30.0 to before 0.30.2 | 0.30.2 | Patch available | GHSA-qvgg-r6rq-vwfx |
- datadog/dd-trace (Packagist) Vendor— Affected 0.30.0 to before 0.30.2 Fixed in 0.30.2 Patch available GHSA-qvgg-r6rq-vwfx
Remediation
- Fix · GHSA-qvgg-r6rq-vwfx datadog/dd-trace (Packagist) Fixed in 0.30.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-qvgg-r6rq-vwfx
References
Other 6
- https://github.com/DataDog/dd-trace-php/pull/579
- https://github.com/DataDog/dd-trace-php/commit/87fc324eb63d533b35464f1dfca946795f2294fd
- https://github.com/DataDog/dd-trace-php
- https://github.com/DataDog/dd-trace-php/releases/tag/0.30.0
- https://github.com/DataDog/dd-trace-php/releases/tag/0.30.2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/datadog/dd-trace/2019-09-26-1.yaml
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences