An env_path_info underflow in PHP-FPM lets a crafted URL achieve remote code execution when nginx passes PATH_INFO using a fastcgi_split_path_info regex without checking that the script file exists.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 7.3 | < 7.3.11 | 7.3.11 |
| PHP 7.2 | < 7.2.24 | 7.2.24 |
| PHP 7.1 | < 7.1.33 | 7.1.33 |
Older branches: not assessed
Exploitation conditions
- PHP-FPM behind nginx
- fastcgi_split_path_info with PATH_INFO and no try_files/file existence check
Remediation
Upgrade PHP (all affected branches are end-of-life; move to a supported branch). In nginx, add try_files $fastcgi_script_name =404; or an equivalent file existence check before passing requests to PHP-FPM.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 7.5 v2.0 | NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Severity per vendor ratings; CVSS v3 score not verified in this snapshot.