What’s Vulnerable › Vulnerabilities
CVE-2026-6735: XSS within PHP-FPM status endpoint
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-05-10 · updated 2026-07-24
- Weakness: CWE-79
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Affected products
- PHP: from 8.2.0 before 8.2.31; from 8.3.0 before 8.3.31; from 8.4.0 before 8.4.21; from 8.5.0 before 8.5.6 — fixed in 8.2.31, 8.3.31, 8.4.21, 8.5.6
How to fix
Upgrade to a fixed version: PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6735 or the next vulnerability affects your stack