CVE-2019-11045 in PHP
Summary
by MITRE
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified as CVE-2019-11045 represents a critical security flaw in PHP's DirectoryIterator class that affects multiple versions including 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0. This issue stems from the improper handling of null byte characters within filenames, creating a fundamental security gap that can be exploited by malicious actors to bypass access controls and gain unauthorized system access. The vulnerability manifests when PHP processes directory listings where filenames contain embedded null bytes, causing the system to truncate the filename at the first null byte encountered.
The technical root cause of this vulnerability lies in how PHP's DirectoryIterator class processes and interprets filenames containing null byte characters. When a filename contains a null byte embedded within it, the class treats this byte as a string terminator rather than a legitimate character, effectively truncating the filename at that point. This behavior creates a mismatch between the actual filename stored on the filesystem and how PHP processes it during directory traversal operations. According to CWE-170, this represents a weakness where improper handling of null bytes leads to unexpected behavior in string processing functions, specifically manifesting as improper null termination handling in the context of file system operations.
The operational impact of this vulnerability is severe and multifaceted, particularly in applications that implement path validation or access control mechanisms. Attackers can exploit this weakness by creating filenames with embedded null bytes that appear to be legitimate paths to authorized directories but are actually truncated to shorter, potentially unauthorized paths. This allows attackers to bypass directory access controls and potentially access files or directories that should be restricted. The vulnerability specifically affects applications that perform path validation checks, where the system might validate a path against allowed directories but fail to account for null byte truncation during processing. The ATT&CK framework categorizes this as a privilege escalation technique through path traversal manipulation, where an attacker manipulates file system operations to gain access to restricted resources.
Security implications extend beyond simple path traversal as this vulnerability can enable attackers to circumvent various access control mechanisms that rely on proper filename validation. Applications using DirectoryIterator for file enumeration, access logging, or security checks become vulnerable to manipulation where the embedded null byte allows bypassing validation routines. The vulnerability is particularly dangerous in web applications where user-supplied filenames are processed, as attackers can craft malicious filenames that exploit this behavior to access unauthorized resources. Organizations implementing PHP-based applications must recognize that this vulnerability can be leveraged in various attack scenarios including arbitrary file access, directory traversal, and privilege escalation attacks, making it a critical concern for system security. The flaw essentially creates a backdoor mechanism where legitimate access control checks can be bypassed through careful manipulation of filename encoding.
Mitigation strategies for CVE-2019-11045 require immediate patching of affected PHP versions to the latest stable releases that address this null byte handling issue. System administrators should prioritize updating their PHP installations to versions 7.2.26, 7.3.13, or 7.4.1 respectively, as these releases contain the necessary fixes for proper null byte handling in DirectoryIterator operations. Additionally, applications should implement defensive programming practices including explicit validation of filenames before processing, sanitization of user input, and implementation of proper access control checks that do not rely solely on path validation. Organizations should also consider implementing monitoring solutions to detect potential exploitation attempts involving embedded null bytes in file operations, as this vulnerability can be used in combination with other techniques to create more sophisticated attack vectors. The vulnerability demonstrates the importance of proper string handling in security-critical applications and underscores the necessity of thorough testing of input validation mechanisms against edge cases involving special characters and encoding anomalies.