CVE-2012-0057

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-02 · updated 2026-06-16
Weakness: CWE-264

Description

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.

Affected products

PHP: through 5.3.8; 5.0.0, 5.0.0-beta1, 5.0.0-beta2, 5.0.0-beta3, 5.0.0-beta4, 5.0.0-rc1 (+40)

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html
http://openwall.com/lists/oss-security/2012/01/13/10
http://openwall.com/lists/oss-security/2012/01/13/4
http://openwall.com/lists/oss-security/2012/01/13/5
http://openwall.com/lists/oss-security/2012/01/13/6
http://openwall.com/lists/oss-security/2012/01/13/7
http://openwall.com/lists/oss-security/2012/01/14/1
http://openwall.com/lists/oss-security/2012/01/14/2
http://openwall.com/lists/oss-security/2012/01/14/3

Get alerted when CVE-2012-0057 or the next vulnerability affects your stack