Medium
Security advisory
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11045
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:56 UTC · Revision 1
Source evidence
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
osv:CVE-2019-11045
Complete source record
{
"id": "bc96eaf692053712876f4f75657fc870adba75803cfc77a135b7bf7cf0deee0f",
"url": "https://osv.dev/vulnerability/CVE-2019-11045",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11045",
"summary": "In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \\0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.",
"evidence": "osv:CVE-2019-11045",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-11045",
"aliases": [
"CVE-2019-11045"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/php/php-src",
"type": "GIT",
"events": [
{
"introduced": "8148cbb78841c8ec0759c0836e7f35dec799d300"
},
{
"last_affected": "1df155af14c3b7473b628574eb46a7ce11caadfd"
},
{
"introduced": "52ace952a1b65ca80fc2617f11c2fa6dd03f51bd"
},
{
"last_affected": "a1457cf8b8b82516bf9561eb43972b63074fa9ae"
},
{
"introduced": "3c7824e16ec4c3cee417262445d2c2b66531c10f"
},
{
"last_affected": "3c7824e16ec4c3cee417262445d2c2b66531c10f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.26"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"last_affected": "7.3.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.4.0",
"php-7.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11045.json"
}
}
],
"modified": "2026-10-24T10:30:46.653574784Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/",
"https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html",
"https://seclists.org/bugtraq/2020/Feb/27",
"https://seclists.org/bugtraq/2020/Feb/31",
"https://seclists.org/bugtraq/2021/Jan/3",
"https://security.netapp.com/advisory/ntap-20200103-0002/",
"https://usn.ubuntu.com/4239-1/",
"https://www.debian.org/security/2020/dsa-4626",
"https://www.debian.org/security/2020/dsa-4628",
"https://www.tenable.com/security/tns-2021-14",
"https://bugs.php.net/bug.php?id=78863"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:*"
],
"vendor_product": "tenable:security_center",
"extracted_events": [
{
"range": [
{
"fixed": "5.19.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "12.04"
},
{
"last_affected": "12.04"
},
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.04"
},
{
"last_affected": "19.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-11045",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436379,
"published_at": "2019-12-23T03:15:11.63+00:00"
}