Medium severity5.3NVD Advisory· Published Nov 29, 2021· Updated Jun 17, 2026

CVE-2021-21707

Description

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

103

NetApp/Clustered Data Ontap
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
PHP/PHP3 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.3.0,<7.3.33
- (no CPE)range: <7.3.33, <7.4.26, <8.0.13
- (no CPE)range: 7.3.x
Tenable/Tenable.sc
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
Range: <5.21.0
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
osv-coords96 versions
pkg:bitnami/libphp pkg:bitnami/php pkg:bitnami/php-min pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-ffi pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/opensuse/apache2-mod_php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/apache2-mod_php8&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php7-embed&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7-fastcgi&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7-fpm&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php8&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php8-embed&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php8-fastcgi&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php8-fpm&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php8-test&distro=openSUSE%20Leap%2015.4 pkg:rpm/suse/apache2-mod_php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4 pkg:rpm/suse/apache2-mod_php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP2 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP3 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP3 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/php7&distro=SUSE%20Manager%20Proxy%204.1 pkg:rpm/suse/php7&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1 pkg:rpm/suse/php7&distro=SUSE%20Manager%20Server%204.1 pkg:rpm/suse/php7-embed&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4 pkg:rpm/suse/php7-fastcgi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4 pkg:rpm/suse/php7-fpm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/php74&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php74&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4 pkg:rpm/suse/php8-embed&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4 pkg:rpm/suse/php8-fastcgi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4 pkg:rpm/suse/php8-fpm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4 pkg:rpm/suse/php8-test&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4
>= 7.3.0, < 7.3.33+ 95 more
- (no CPE)range: >= 7.3.0, < 7.3.33
- (no CPE)range: >= 7.3.0, < 7.3.33
- (no CPE)range: >= 7.3.0, < 7.3.33
- (no CPE)range: < 5.1.18-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 1.6.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 1.6.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 1.6.1-1.module_el8.6.0+3239+bedf0508
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 1:1.10.13-1.module_el8.6.0+3268+b150a051
- (no CPE)range: < 5.1.18-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 5.1.18-1.module_el8.6.0+3239+bedf0508
- (no CPE)range: < 2.0.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 2.9.5-1.module_el8.6.0+3239+bedf0508
- (no CPE)range: < 1.18.2-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.30-1.module_el8.7.0+3286+227f3cf0
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 7.4.6-lp152.2.21.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.26-1.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.6-lp152.2.21.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.13-1.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.6-3.29.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.6-3.29.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.33-150200.3.46.2
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.4.25-150400.4.8.1
- (no CPE)range: < 7.2.5-1.75.1
- (no CPE)range: < 7.2.5-1.75.1
- (no CPE)range: < 7.4.6-1.30.1
- (no CPE)range: < 7.4.6-1.30.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1
- (no CPE)range: < 8.0.10-150400.4.8.1

Patches

Vulnerability mechanics

References

www.tenable.com/security/tns-2022-09nvdPatchRelease NotesThird Party Advisory
bugs.php.net/bug.phpnvdExploitIssue TrackingPatchRelease NotesVendor Advisory
security.netapp.com/advisory/ntap-20211223-0005/nvdThird Party Advisory
www.debian.org/security/2022/dsa-5082nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2022/12/msg00030.htmlnvdIssue TrackingMailing List

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.021
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000