What’s Vulnerable › Vulnerabilities

CVE-2022-31631: PDO::quote() may return unquoted string

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-12 · updated 2026-06-17
• Weakness: CWE-74

Description

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

Affected products

• PHP: from 8.0.0 before 8.0.27; from 8.1.0 before 8.1.15; from 8.2.0 before 8.2.2 — fixed in 8.0.27, 8.1.15, 8.2.2

How to fix

Upgrade to a fixed version: PHP 8.0.27, 8.1.15, 8.2.2. Check the vendor advisory for mitigations.

References

• https://bugs.php.net/bug.php?id=81740
• https://security.netapp.com/advisory/ntap-20230223-0007/
• https://bugs.php.net/bug.php?id=81740

Get alerted when CVE-2022-31631 or the next vulnerability affects your stack