VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 16, 2011· Updated Apr 29, 2026

CVE-2011-2202

CVE-2011-2202

Description

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

PHP before 5.3.7 fails to restrict filenames in multipart/form-data POST requests, allowing absolute path traversal and arbitrary file overwrite via crafted uploads.

Vulnerability

The rfc1867_post_handler function in main/rfc1867.c in PHP versions prior to 5.3.7 does not properly validate filenames in multipart/form-data POST requests. This file path injection vulnerability allows a remote attacker to specify an absolute path as the filename, bypassing intended restrictions. Affected versions include all PHP releases before 5.3.7 [1][2].

Exploitation

An attacker sends a specially crafted HTTP POST request with a multipart/form-data file upload. By setting the filename field to an absolute path (e.g., /etc/passwd or /var/www/html/shell.php), the attacker can cause PHP to write the uploaded content to an arbitrary location on the server filesystem. No authentication is required if the target application accepts file uploads. The request triggers an absolute path traversal [2][3].

Impact

Successful exploitation allows a remote attacker to create or overwrite arbitrary files on the server. This can lead to complete compromise of the web server, including overwriting critical system files, injecting malicious code (e.g., a web shell), or modifying configuration files. The impact is high, potentially resulting in remote code execution or denial of service [2][4].

Mitigation

The vulnerability is fixed in PHP version 5.3.7, released on August 18, 2011 [1][3]. Users should upgrade to PHP 5.3.7 or later immediately. For systems that cannot be upgraded, as a temporary workaround, disable the file upload functionality or use a web application firewall to filter arbitrary filename paths. Red Hat Enterprise Linux 4 received a backported fix in RHSA-2012:0071 [2]. Apple addressed the issue in OS X Lion v10.7.3, as noted in HT5130 [4].

References
  1. PHP: PHP 5 ChangeLog
  2. http://rhn.redhat.com/errata/RHSA-2012-0071.html
  3. PHP: News Archive - 2011
  4. About the security content of OS X Lion v10.7.3 and Security Update 2012-001 - Apple Support

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

76
  • PHP/PHP72 versions
    cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 71 more
    • cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.3.6
    • cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
  • Zendframework;php/PHPllm-fuzzy
    Range: <5.3.7
  • osv-coords3 versions
    pkg:rpm/opensuse/php5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
    < 5.6.28-1.1+ 2 more
    • (no CPE)range: < 5.6.28-1.1
    • (no CPE)range: < 7.0.14-1.4
    • (no CPE)range: < 8.0.11-1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

21

News mentions

0

No linked articles in our index yet.