Уязвимость менеджера фоновых процессов PHP-FPM интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный JavaScript-код (XSS)

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

XSS within PHP-FPM status endpoint

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before ...

XSS within PHP-FPM status endpoint

Important: php:8.2 security update

Important: php:8.2 security update

Important: php:8.3 security update

ELSA-2026-22305: php:8.2 security update (IMPORTANT)

ELSA-2026-22143: php:8.2 security update (IMPORTANT)

ELSA-2026-22142: php:8.3 security update (IMPORTANT)

Important: php security update

ELSA-2026-23388: php security update (IMPORTANT)

Security update for php7

Important: php:7.4 security update

Important: php8.4 security update

ELSA-2026-34354: php:7.4 security update (IMPORTANT)

ELSA-2026-22649: php8.4 security update (IMPORTANT)