Medium severity5.5NVD Advisory· Published Jul 30, 2026· Updated Aug 5, 2026

CVE-2026-7260

Description

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP2 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=8.2.0,<8.2.33
- (no CPE)range: <8.2.33, <8.3.33, <8.4.24, <8.5.9
osv-coords74 versions
pkg:bitnami/libphp pkg:bitnami/php pkg:bitnami/php-min pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-ffi pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-redis6 pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-pecl-xdebug3 pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/almalinux/php8.4 pkg:rpm/almalinux/php8.4-bcmath pkg:rpm/almalinux/php8.4-cli pkg:rpm/almalinux/php8.4-common pkg:rpm/almalinux/php8.4-dba pkg:rpm/almalinux/php8.4-dbg pkg:rpm/almalinux/php8.4-devel pkg:rpm/almalinux/php8.4-embedded pkg:rpm/almalinux/php8.4-enchant pkg:rpm/almalinux/php8.4-ffi pkg:rpm/almalinux/php8.4-fpm pkg:rpm/almalinux/php8.4-gd pkg:rpm/almalinux/php8.4-gmp pkg:rpm/almalinux/php8.4-intl pkg:rpm/almalinux/php8.4-ldap pkg:rpm/almalinux/php8.4-mbstring pkg:rpm/almalinux/php8.4-mysqlnd pkg:rpm/almalinux/php8.4-odbc pkg:rpm/almalinux/php8.4-opcache pkg:rpm/almalinux/php8.4-pdo pkg:rpm/almalinux/php8.4-pgsql pkg:rpm/almalinux/php8.4-process pkg:rpm/almalinux/php8.4-snmp pkg:rpm/almalinux/php8.4-soap pkg:rpm/almalinux/php8.4-xml pkg:rpm/opensuse/apache2-mod_php8&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/php8&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php8-embed&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/php8-fastcgi&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/php8-fpm&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/php8-test&distro=openSUSE%20Leap%2016.0
>= 8.2.0, < 8.2.33+ 73 more
- (no CPE)range: >= 8.2.0, < 8.2.33
- (no CPE)range: >= 8.2.0, < 8.2.33
- (no CPE)range: >= 8.2.0, < 8.2.33
- (no CPE)range: < 5.1.23-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 7.4.33-6.module_el8.10.0+4266+b824362a
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 5.1.23-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 5.1.23-1.module_el9.8.0+287+a9a5bb73
- (no CPE)range: < 6.1.0-3.module_el9.8.0+257+89d727f2
- (no CPE)range: < 2.0.3-4.module_el9.8.0+287+a9a5bb73
- (no CPE)range: < 2.9.5-1.module_el8.10.0+3935+28808425
- (no CPE)range: < 3.3.1-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 1.22.3-1.module_el9.6.0+151+5f31e576
- (no CPE)range: < 8.3.33-1.module_el9.8.0+296+9aab6c42
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 8.3.33-1.module_el9.8.0+297+88e7f1bf
- (no CPE)range: < 7.4.33-6.module_el8.10.0+4266+b824362a
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.5.9-1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1

Patches

Vulnerability mechanics

References

github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3nvdVendor Advisory

News mentions

PHP: Three Vulnerabilities Including SQLi and Memory Corruption Disclosed Together
Vypr Intelligence · Jul 31, 2026
PHP Patches Three Flaws Enabling SQL Injection, Memory Corruption and Server Crashes
Cyber Security News · Jul 31, 2026

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000