CVE-2026-6735 in PHP
Summary
by MITRE • 05/10/2026
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/03/2026
This vulnerability represents a critical cross-site scripting flaw that affects multiple PHP versions including 8.2.31, 8.3.31, 8.4.21, and 8.5.6, where insufficient input validation allows attackers to inject malicious JavaScript code through specially crafted URLs. The flaw specifically targets PHP-FPM status pages which are typically used for monitoring and administrative purposes, making them prime targets for exploitation. When users with appropriate privileges access these status pages, the malicious code executes in their browser context, potentially leading to complete session hijacking, data exfiltration, or further attack vector exploitation. The vulnerability stems from improper sanitization of user-provided data within URL parameters that are subsequently rendered in the status page output without adequate encoding or validation. This type of vulnerability maps directly to CWE-79 - Cross-site Scripting, which is classified as a fundamental web application security weakness. The attack vector operates through the manipulation of URL parameters that are processed by PHP-FPM and then displayed on the status page, creating a direct code execution path in the victim's browser environment. The operational impact is significant as PHP-FPM status pages are often accessible to administrators and system users who may have elevated privileges, making this a potential gateway for privilege escalation attacks. Organizations running affected PHP versions face substantial risk of unauthorized access and data compromise when these status pages are accessible to untrusted users. The exploitation requires minimal technical skill as attackers only need to craft a malicious URL and convince a victim to view the PHP-FPM status page. The vulnerability aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, as it enables execution of malicious JavaScript code in the victim's browser context. Security practitioners should note that this vulnerability affects the core PHP processing pipeline rather than specific applications, meaning that any application using affected PHP versions could be compromised. The fix requires updating to the patched versions of PHP where proper input sanitization has been implemented to prevent user data from being rendered as executable JavaScript code. Organizations should immediately disable access to PHP-FPM status pages from untrusted networks and implement proper URL parameter validation across all web applications to prevent similar vulnerabilities. Additionally, monitoring for suspicious URL patterns and implementing Content Security Policies can help mitigate the risk of exploitation in environments where immediate patching is not immediately feasible.