CVE-2026-6735
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, an attacker can craft a URL that causes arbitrary JavaScript execution (XSS) on the target's machine when viewing the PHP-FPM status page.
Risk Assessment
An attacker can steal user sessions or redirect users to malicious sites, threatening data confidentiality and integrity.
Recommendation
It is recommended to immediately update PHP to version 8.2.31, 8.3.31, 8.4.21, or 8.5.6 depending on the branch used.
Original NVD description (English source)
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.