proc_open() with array syntax does not escape arguments sufficiently for cmd.exe, letting an attacker who controls arguments execute arbitrary shell commands on Windows.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.3 | < 8.3.6 | 8.3.6 |
| PHP 8.2 | < 8.2.18 | 8.2.18 |
| PHP 8.1 | < 8.1.28 | 8.1.28 |
Older branches: not assessed
Exploitation conditions
- Windows only
- proc_open() with array syntax and attacker-influenced arguments
Remediation
Upgrade to 8.1.28, 8.2.18, 8.3.6 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 9.4 v3.1 | CNA | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: The CVE description says "8.3.* before 8.3.5", but 8.3.5 was never released as a stable version; the fix shipped in 8.3.6.