CVE-2026-17545

Description

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

Is your site exposed to CVE-2026-17545?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-67 CWE-67

References

Other References

https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp

Frequently Asked Questions

What is CVE-2026-17545? +

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

How do I check if I'm vulnerable to CVE-2026-17545? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-51745 10.0

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device …

CVE-2024-35197 5.4

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from …

CVE-2025-66221 5.3

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows …