CVE-2004-1392

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read...

5.0 MediumPublic exploitFix available

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Exploit likelihood

10.8%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Record: CVE-2004-1392
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Record: CVE-2004-1392
Updated: 2026-11-02

EUVDEUVD-2004-1389 No score

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Record: EUVD-2004-1389
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5h5w-vq2m-cxf3 No score

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read...

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Record: GHSA-5h5w-vq2m-cxf3
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-debuginfo` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-devel` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-imap` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-ldap` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-mysql` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-odbc` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-pgsql` Red Hat:enterprise_linux:3::as	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent

Show 82 moreShow less

Affected packages
Package	Affected	Fixed
`php-devel` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-imap` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-ldap` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-mysql` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-odbc` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-pgsql` Red Hat:enterprise_linux:3::desktop	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-debuginfo` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-devel` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-imap` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-ldap` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-mysql` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-odbc` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-pgsql` Red Hat:enterprise_linux:3::es	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-devel` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-imap` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-ldap` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-mysql` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-odbc` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php-pgsql` Red Hat:enterprise_linux:3::ws	before 0:4.3.2-23.ent	0:4.3.2-23.ent
`php` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-debuginfo` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-devel` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-domxml` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-gd` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-imap` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ldap` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mbstring` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mysql` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ncurses` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-odbc` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pear` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pgsql` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-snmp` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-xmlrpc` Red Hat:enterprise_linux:4::as	before 0:4.3.9-3.6	0:4.3.9-3.6
`php` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-devel` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-domxml` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-gd` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-imap` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ldap` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mbstring` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mysql` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ncurses` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-odbc` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pear` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pgsql` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-snmp` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-xmlrpc` Red Hat:enterprise_linux:4::desktop	before 0:4.3.9-3.6	0:4.3.9-3.6
`php` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-debuginfo` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-devel` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-domxml` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-gd` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-imap` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ldap` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mbstring` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mysql` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ncurses` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-odbc` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pear` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pgsql` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-snmp` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-xmlrpc` Red Hat:enterprise_linux:4::es	before 0:4.3.9-3.6	0:4.3.9-3.6
`php` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-devel` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-domxml` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-gd` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-imap` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ldap` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mbstring` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-mysql` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-ncurses` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-odbc` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pear` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-pgsql` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-snmp` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6
`php-xmlrpc` Red Hat:enterprise_linux:4::ws	before 0:4.3.9-3.6	0:4.3.9-3.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PHP 4.x/5 - cURL 'open_basedir' Restriction Bypass	2004-10-28

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-1392 is a medium vulnerability (CVSS 5.0) in Php, published December 31, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.8%, the 95th percentile. Fixed in php 0:4.3.2-23.ent.

References

Show 37 moreShow less