What’s Vulnerable › Vulnerabilities

CVE-2024-8927: cgi.force_redirect configuration is bypassable due to the environment variable collision

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-08 · updated 2026-06-17
• Weakness: CWE-1220

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

Affected products

• PHP: from 8.1.0 before 8.1.30; from 8.2.0 before 8.2.24; from 8.3.0 before 8.3.12 — fixed in 8.1.30, 8.2.24, 8.3.12

How to fix

Upgrade to a fixed version: PHP 8.1.30, 8.2.24, 8.3.12. Check the vendor advisory for mitigations.

References

• https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
• https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html
• https://security.netapp.com/advisory/ntap-20241101-0003/

Get alerted when CVE-2024-8927 or the next vulnerability affects your stack