UpHeron
All vulnerabilities

Servers and applications

CVE-2011-0754

The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.

Severity
Medium 4.4
Published
2 Feb 2011
Last changed
16 Jun 2026
Added to UpHeron
14 Oct 2026
Exploit chance
0.3% in the next 30 daysHigher than 27% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Link following (CWE-59)
Attack
Needs local access · No login needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:L/AC:M/Au:N/C:P/I:P/A:P
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 5.3.2
  • Version 5.3.1
  • Version 5.3.0
  • Version 4.4.9
All 68 release lines
  • Every version up to 5.3.3
  • Version 1.0
  • Version 2.0b10
  • Version 2.0
  • Version 3.0
  • Version 3.0.1
  • Version 3.0.2
  • Version 3.0.3
  • Version 3.0.4
  • Version 3.0.5
  • Version 3.0.6
  • Version 3.0.7
  • Version 3.0.8
  • Version 3.0.9
  • Version 3.0.10
  • Version 3.0.11
  • Version 3.0.12
  • Version 3.0.13
  • Version 3.0.14
  • Version 3.0.15
  • Version 3.0.16
  • Version 3.0.17
  • Version 3.0.18
  • Version 4.0-beta1
  • Version 4.0-beta2
  • Version 4.0-beta3
  • Version 4.0-beta4
  • Version 4.0-beta_4_patch1
  • Version 4.0
  • Version 4.0.1
  • Version 4.0.2
  • Version 4.0.3
  • Version 4.0.4
  • Version 4.0.5
  • Version 4.0.6
  • Version 4.0.7
  • Version 4.1.0
  • Version 4.1.1
  • Version 4.1.2
  • Version 4.2.0
  • Version 4.2.1
  • Version 4.2.2
  • Version 4.2.3
  • Version 4.3.0
  • Version 4.3.1
  • Version 4.3.2
  • Version 4.3.3
  • Version 4.3.4
  • Version 4.3.5
  • Version 4.3.6
  • Version 4.3.7
  • Version 4.3.8
  • Version 4.3.9
  • Version 4.3.10
  • Version 4.3.11
  • Version 4.4.0
  • Version 4.4.1
  • Version 4.4.2
  • Version 4.4.3
  • Version 4.4.4
  • Version 4.4.5
  • Version 4.4.6
  • Version 4.4.7
  • Version 4.4.8
  • Version 4.4.9
  • Version 5.3.0
  • Version 5.3.1
  • Version 5.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-0754
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-0754