CVE-2026-7260 in PHP
Summary
by MITRE • 07/30/2026
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical stack exhaustion issue affecting PHP's handling of phar archives through circular symbolic links that create unbounded recursion during archive processing. The flaw exists in PHP versions ranging from 8.2.0 through 8.2.32, 8.3.0 through 8.3.32, 8.4.0 through 8.4.23, and 8.5.0 through 8.5.8, where the phar extension fails to properly detect and terminate recursive symbolic link chains. When a maliciously crafted phar archive contains circular symbolic links pointing to itself or other archives in a loop, PHP's internal archive parsing logic enters infinite recursion, consuming stack space until the process crashes with a stack overflow error.
The technical implementation of this vulnerability stems from insufficient boundary checking within PHP's phar extension during archive traversal operations. When processing phar archives, the system recursively follows symbolic links without maintaining proper state tracking to detect circular references, creating an unbounded recursion scenario that directly maps to CWE-674 - Uncontrolled Recursion. This behavior aligns with ATT&CK technique T1203 - Exploitation for Client Execution, as it enables remote code execution through malicious phar archives when combined with other attack vectors.
The operational impact of this vulnerability extends beyond simple process crashes, potentially enabling denial-of-service attacks against PHP applications that process untrusted phar files. Attackers can craft malicious archives that cause PHP processes to consume excessive memory and stack resources, leading to application instability and potential service disruption. This issue particularly affects web applications that accept user-uploaded files or process third-party archive data, as the vulnerability can be exploited through any code path that utilizes PHP's phar extension for archive handling. The vulnerability is especially concerning in environments where multiple concurrent PHP processes are running, as it can lead to widespread system instability.
Mitigation strategies should focus on immediate version upgrades to patched PHP releases, as well as implementing defensive programming practices such as establishing maximum recursion limits and proper symbolic link validation before processing phar archives. Administrators should also consider restricting phar archive processing in applications where user input is involved, implementing strict file type validation, and monitoring for unusual memory consumption patterns that may indicate exploitation attempts. The vulnerability demonstrates the importance of proper resource management in archive processing systems and highlights the need for comprehensive boundary checking mechanisms to prevent recursive traversal attacks.