CVE-2026-6735

MEDIUM

XSS within PHP-FPM status endpoint

Title source: cna
STIX 2.1

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

Scores

CVSS v3 6.1
EPSS 0.0005
EPSS Percentile 14.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (5)
php/php 8.2.0 - 8.2.31
PHP Group/PHP 8.2.* - 8.2.31
PHP Group/PHP 8.3.* - 8.3.31
PHP Group/PHP 8.4.* - 8.4.21
PHP Group/PHP 8.5.* - 8.5.6
Published May 10, 2026
Tracked Since May 10, 2026