UpHeron
All vulnerabilities

Servers and applications

CVE-2026-7260

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Severity
Medium 5.4
Published
30 Jul 2026
Last changed
5 Aug 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.2.33, 8.3.33, 8.4.24, 8.5.9
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.2.0 before 8.2.33
  • From 8.3.0 before 8.3.33
  • From 8.4.0 before 8.4.24
  • From 8.5.0 before 8.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-7260
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7260