What’s Vulnerable › Vulnerabilities

CVE-2024-8925: Erroneous parsing of multipart form data

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-08 · updated 2026-06-17
• Weakness: CWE-444

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Affected products

• PHP: from 8.1.0 before 8.1.30; from 8.2.0 before 8.2.24; from 8.3.0 before 8.3.12 — fixed in 8.1.30, 8.2.24, 8.3.12

How to fix

Upgrade to a fixed version: PHP 8.1.30, 8.2.24, 8.3.12. Check the vendor advisory for mitigations.

References

• https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
• https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html
• https://security.netapp.com/advisory/ntap-20241101-0003/

Get alerted when CVE-2024-8925 or the next vulnerability affects your stack