UpHeron
All vulnerabilities

Servers and applications

CVE-2015-2348

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix…

Severity
Medium 5.0
Published
30 Mar 2015
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 5.6.6
  • Version 5.6.5
  • Version 5.6.4
  • Version 5.6.3
All 51 release lines
  • Every version up to 5.4.38
  • Version 5.5.0-alpha1
  • Version 5.5.0-alpha2
  • Version 5.5.0-alpha3
  • Version 5.5.0-alpha4
  • Version 5.5.0-alpha5
  • Version 5.5.0-alpha6
  • Version 5.5.0-beta1
  • Version 5.5.0-beta2
  • Version 5.5.0-beta3
  • Version 5.5.0-beta4
  • Version 5.5.0-rc1
  • Version 5.5.0-rc2
  • Version 5.5.0
  • Version 5.5.1
  • Version 5.5.2
  • Version 5.5.3
  • Version 5.5.4
  • Version 5.5.5
  • Version 5.5.6
  • Version 5.5.7
  • Version 5.5.8
  • Version 5.5.9
  • Version 5.5.10
  • Version 5.5.11
  • Version 5.5.12
  • Version 5.5.13
  • Version 5.5.14
  • Version 5.5.15
  • Version 5.5.16
  • Version 5.5.17
  • Version 5.5.18
  • Version 5.5.19
  • Version 5.5.20
  • Version 5.5.21
  • Version 5.5.22
  • Version 5.6.0-alpha1
  • Version 5.6.0-alpha2
  • Version 5.6.0-alpha3
  • Version 5.6.0-alpha4
  • Version 5.6.0-alpha5
  • Version 5.6.0-beta1
  • Version 5.6.0-beta2
  • Version 5.6.0-beta3
  • Version 5.6.0-beta4
  • Version 5.6.1
  • Version 5.6.2
  • Version 5.6.3
  • Version 5.6.4
  • Version 5.6.5
  • Version 5.6.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-2348
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-2348