Servers and applications
CVE-2014-5120 gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Severity Medium 6.4
Published 23 Aug 2014
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.5.15 Version 5.5.14 Version 5.5.13 Version 5.5.12 All 67 release lines Version 5.4.0-beta2 Version 5.4.0-rc2 Version 5.4.0 Version 5.4.1 Version 5.4.2 Version 5.4.3 Version 5.4.4 Version 5.4.5 Version 5.4.6 Version 5.4.7 Version 5.4.8 Version 5.4.9 Version 5.4.10 Version 5.4.11 Version 5.4.12-rc1 Version 5.4.12-rc2 Version 5.4.12 Version 5.4.13-rc1 Version 5.4.13 Version 5.4.14-rc1 Version 5.4.14 Version 5.4.15-rc1 Version 5.4.15 Version 5.4.16-rc1 Version 5.4.17 Version 5.4.18 Version 5.4.19 Version 5.4.20 Version 5.4.21 Version 5.4.22 Version 5.4.23 Version 5.4.24 Version 5.4.25 Version 5.4.26 Version 5.4.27 Version 5.4.28 Version 5.4.29 Version 5.4.30 Version 5.4.31 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-5120 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-5120