XSS within PHP-FPM status endpoint

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

XSS within PHP-FPM status endpoint

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before ...

Уязвимость менеджера фоновых процессов PHP-FPM интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный JavaScript-код (XSS)

Important: php:8.2 security update

Important: php:8.2 security update

Important: php:8.3 security update

ELSA-2026-22305: php:8.2 security update (IMPORTANT)

ELSA-2026-22143: php:8.2 security update (IMPORTANT)

ELSA-2026-22142: php:8.3 security update (IMPORTANT)

Important: php security update

Security update for php7

Important: php:7.4 security update

Important: php8.4 security update

ELSA-2026-34354: php:7.4 security update (IMPORTANT)

ELSA-2026-33449: php security update (IMPORTANT)

Security update for php8