Php · Php · CVE-2026-6735
**Name of the Vulnerable Software and Affected Versions**
PHP versions 8.2.0 through 8.2.30
PHP versions 8.3.0 through 8.3.30
PHP versions 8.4.0 through 8.4.20
PHP versions 8.5.0 through 8.5.5
**Description**
Improper sanitation of user data allows an attacker to compose a URL that executes arbitrary JavaScript code (Cross-Site Scripting) on a user's machine when viewing the PHP-FPM status page.
**Recommendations**
Update to version 8.2.31
Update to version 8.3.31
Update to version 8.4.21
Update to version 8.5.6