CVE-2026-17545

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description On Windows, filesystem and stream APIs fail to reject reserved device names when they are part of a path. These reserved names include CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9, CONIN$, and CONOUT$. Consequently, an attacker-controlled filename can reach the CreateFileW() function and open a device instead of a standard file. This behavior can lead to a Denial of Service (DoS) by blocking or hanging requests and exhausting worker processes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.