CVE-2024-1874

2024-04-2900:00:00

ubuntu.com

command injection

proc_open

array-ish parameter

windows

debian

pear

php

9.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.4%

JSON

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before
8.3.5, when using proc_open() command with array syntax, due to
insufficient escaping, if the arguments of the executed command are
controlled by a malicious user, the user can supply arguments that would
execute arbitrary commands in Windows shell.

Notes

Author	Note
leosilva	from debian “Only affects improper handling of command line arguments on Windows”
sbeattie	PEAR issues should go against php-pear as of xenial