CVE-2026-17545
published 2026-09-25CVE-2026-17545: On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
30.4th percentile
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php | php | >= 8.2.0 < 8.2.34 | 8.2.34 |
| php | php | >= 8.3.0 < 8.3.35 | 8.3.35 |
| php | php | >= 8.4.0 < 8.4.26 | 8.4.26 |
| php | php | >= 8.5.0 < 8.5.11 | 8.5.11 |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 Filesystem CreateFileW input validation (EUVD-2026-87329)
vuldb·2026-09-25·CVSS 6.9
CVE-2026-17545 [MEDIUM] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 Filesystem CreateFileW input validation (EUVD-2026-87329)
A vulnerability has been found in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 and classified as critical. Affected by this issue is the function CreateFileW of the component Filesystem. This manipulation causes improper input validation.
This vulnerability is registered as CVE-2026-17545. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
Red Hat
php: PHP: Denial of Service via reserved device names on Windows
vendor_redhat·2026-09-25·CVSS 6.9
CVE-2026-17545 [MEDIUM] CWE-66 php: PHP: Denial of Service via reserved device names on Windows
php: PHP: Denial of Service via reserved device names on Windows
A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This can cause application worker processes to block or hang indefinitely, resulting in a Denial of Service (DoS) through resource exhaustion.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php8.4 (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Out of support scope
Package: php (Red Hat Enterprise Linux 7) - Fix deferred
Package: php:7.4/php (Red Hat Enterprise Linux 8) - Fix
No detection rules found.
No public exploits indexed.
2026-09-25
Published