Servers and applications
CVE-2016-4072 The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.
Severity Critical 9.8
Published 20 May 2016
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 7.0.4 Version 7.0.3 Version 7.0.2 Version 7.0.1 All 78 release lines Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 5.5.25 Version 5.5.26 Version 5.5.27 Version 5.5.29 Version 5.5.30 Version 5.5.31 Version 5.5.32 Version 5.5.33 Version 5.6.0-alpha1 Version 5.6.0-alpha2 Version 5.6.0-alpha3 Version 5.6.0-alpha4 Version 5.6.0-alpha5 Version 5.6.0-beta1 Version 5.6.0-beta2 Version 5.6.0-beta3 Version 5.6.0-beta4 Version 5.6.1 Version 5.6.2 Version 5.6.3 Version 5.6.4 Version 5.6.5 Version 5.6.6 Version 5.6.7 Version 5.6.8 Version 5.6.9 Version 5.6.10 Version 5.6.11 Version 5.6.12 Version 5.6.13 Version 5.6.14 Version 5.6.15 Version 5.6.16 Version 5.6.17 Version 5.6.18 Version 5.6.19 Version 7.0.0 Version 7.0.1 Version 7.0.2 Version 7.0.3 Version 7.0.4
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-4072 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-4072