Fluid Attacks Database

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	php8.2	=8.2.10-1 \|\| =8.2.10-2 \|\| =8.2.12-1 \|\| =8.2.16-1 \|\| =8.2.16-2 \|\| =8.2.17-1 \|\| =8.2.18-1 \|\| =8.2.18-1~deb12u1 \|\| =8.2.20-1~deb12u1 \|\| =8.2.20-2 \|\| =8.2.20-3 \|\| =8.2.21-1 \|\| =8.2.23-1 \|\| =8.2.24-1 \|\| =8.2.24-1~deb12u1 \|\| =8.2.26-1~deb12u1 \|\| =8.2.26-4 \|\| =8.2.27-1 \|\| =8.2.28-1~deb12u1 \|\| =8.2.29-1~deb12u1 \|\| =8.2.30-1~deb12u1 \|\| =8.2.5-2 \|\| =8.2.7-1 \|\| =8.2.7-1.1 \|\| =8.2.7-1.2 \|\| =8.2.7-1~deb12u1 \|\| >=0 <8.2.31-1~deb12u1	8.2.31-1~deb12u1
debian 13	php8.4	=8.4.11-1 \|\| =8.4.16-1 \|\| =8.4.16-1~deb13u1 \|\| =8.4.20-1 \|\| >=0 <8.4.21-1~deb13u1	8.4.21-1~deb13u1
rpm rhel7	php	-	-
rpm rhel6	php	-	-
rpm rhel9	php	<0:8.0.30-6.el9_8	0:8.0.30-6.el9_8
rpm rhel10	php	<0:8.3.31-1.el10_2	0:8.3.31-1.el10_2
rpm rhel10	php8.4	<0:8.4.21-1.el10_2	0:8.4.21-1.el10_2
rpm rhel8	php	<0:7.4.33-4.module+el8.10.0+24352+91532d3e	0:7.4.33-4.module+el8.10.0+24352+91532d3e
debian 14	php8.4	=8.4.11-1 \|\| =8.4.16-1 \|\| =8.4.16-1~deb13u1 \|\| =8.4.20-1 \|\| =8.4.21-1~deb13u1 \|\| >=0 <8.4.21-1	8.4.21-1

Aliases

1. CVE-2026-67352. NVD-2026-67353. OSV-DEBIAN-2026-67354. OSV-2026-67355. SECURITY-TRACKER-CVE-2026-6735

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.