Improper Handling of Windows Device Names in PHP - CVE-2026-17545
Published: November 5, 2026
Vulnerability identifier: #VU159402
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-17545
CWE-ID: CWE-67
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by blocking requests and exhausting application worker processes.
The vulnerability exists due to improper handling of Windows device names in PHP's filesystem and stream APIs when processing paths built from user-controlled filenames. A remote attacker can submit repeated requests containing a reserved device name, such as ?file=CONIN$, to make CreateFileW() open a device instead of an ordinary file, blocking requests while the device waits for input and exhausting the worker pool.
Affected software
PHP
How to mitigate CVE-2026-17545
Install security update from vendor's website.
PHP - addressed in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11