Medium severity6.1NVD Advisory· Published May 10, 2026· Updated Jul 24, 2026
CVE-2026-6735
CVE-2026-6735
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
73- osv-coords70 versionspkg:apk/chainguard/php-8.2pkg:apk/wolfi/php-8.2pkg:bitnami/libphppkg:bitnami/phppkg:bitnami/php-minpkg:rpm/almalinux/apcu-panelpkg:rpm/almalinux/libzippkg:rpm/almalinux/libzip-develpkg:rpm/almalinux/libzip-toolspkg:rpm/almalinux/phppkg:rpm/almalinux/php-bcmathpkg:rpm/almalinux/php-clipkg:rpm/almalinux/php-commonpkg:rpm/almalinux/php-dbapkg:rpm/almalinux/php-dbgpkg:rpm/almalinux/php-develpkg:rpm/almalinux/php-embeddedpkg:rpm/almalinux/php-enchantpkg:rpm/almalinux/php-ffipkg:rpm/almalinux/php-fpmpkg:rpm/almalinux/php-gdpkg:rpm/almalinux/php-gmppkg:rpm/almalinux/php-intlpkg:rpm/almalinux/php-jsonpkg:rpm/almalinux/php-ldappkg:rpm/almalinux/php-mbstringpkg:rpm/almalinux/php-mysqlndpkg:rpm/almalinux/php-odbcpkg:rpm/almalinux/php-opcachepkg:rpm/almalinux/php-pdopkg:rpm/almalinux/php-pearpkg:rpm/almalinux/php-pecl-apcupkg:rpm/almalinux/php-pecl-apcu-develpkg:rpm/almalinux/php-pecl-redis6pkg:rpm/almalinux/php-pecl-rrdpkg:rpm/almalinux/php-pecl-xdebugpkg:rpm/almalinux/php-pecl-xdebug3pkg:rpm/almalinux/php-pecl-zippkg:rpm/almalinux/php-pgsqlpkg:rpm/almalinux/php-processpkg:rpm/almalinux/php-snmppkg:rpm/almalinux/php-soappkg:rpm/almalinux/php-xmlpkg:rpm/almalinux/php-xmlrpcpkg:rpm/almalinux/php8.4pkg:rpm/almalinux/php8.4-bcmathpkg:rpm/almalinux/php8.4-clipkg:rpm/almalinux/php8.4-commonpkg:rpm/almalinux/php8.4-dbapkg:rpm/almalinux/php8.4-dbgpkg:rpm/almalinux/php8.4-develpkg:rpm/almalinux/php8.4-embeddedpkg:rpm/almalinux/php8.4-enchantpkg:rpm/almalinux/php8.4-ffipkg:rpm/almalinux/php8.4-fpmpkg:rpm/almalinux/php8.4-gdpkg:rpm/almalinux/php8.4-gmppkg:rpm/almalinux/php8.4-intlpkg:rpm/almalinux/php8.4-ldappkg:rpm/almalinux/php8.4-mbstringpkg:rpm/almalinux/php8.4-mysqlndpkg:rpm/almalinux/php8.4-odbcpkg:rpm/almalinux/php8.4-opcachepkg:rpm/almalinux/php8.4-pdopkg:rpm/almalinux/php8.4-pgsqlpkg:rpm/almalinux/php8.4-processpkg:rpm/almalinux/php8.4-snmppkg:rpm/almalinux/php8.4-soappkg:rpm/almalinux/php8.4-xmlpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
< 8.2.31-r0+ 69 more
- (no CPE)range: < 8.2.31-r0
- (no CPE)range: < 8.2.31-r0
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: < 5.1.23-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 7.4.33-4.module_el8.10.0+4209+2ed16ff0
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 5.1.23-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 5.1.23-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 6.1.0-2.module_el9.6.0+151+5f31e576
- (no CPE)range: < 2.0.3-4.module_el9.6.0+151+5f31e576
- (no CPE)range: < 2.9.5-1.module_el8.10.0+3935+28808425
- (no CPE)range: < 3.3.1-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 1.22.3-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 8.3.31-2.module_el9.8.0+255+747189f2
- (no CPE)range: < 7.4.33-4.module_el8.10.0+4209+2ed16ff0
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.4.21-1.el10_2
- (no CPE)range: < 8.5.6-1.1
Patches
Vulnerability mechanics
References
1- github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwvnvdExploitVendor Advisory
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026