CVE-2024-8927
HIGHDescription
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
Is your site exposed to CVE-2024-8927?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| php | php |
| php | php |
| php | php |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2024-8927? +
How severe is CVE-2024-8927? +
What products are affected by CVE-2024-8927? +
How do I check if I'm vulnerable to CVE-2024-8927? +
Related Vulnerabilities
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain …
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially …
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS …
A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through …
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where …