CVE-2011-3744
HTML Purifier allows remote attackers to obtain sensitive information
CVE-2011-3744 is a medium vulnerability (CVSS 5.0) in Htmlpurifier Html Purifier, published September 23, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. No source names a fixed version.
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
Exploit likelihood
What each source reports
NVD Score used
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
CVE-2011-3744- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
CVE-2011-3744- Updated
- 2026-11-02
EUVDEUVD-2022-4441 No score
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
EUVD-2022-4441- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jw86-5cjf-mv79
HTML Purifier allows remote attackers to obtain sensitive information
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
GHSA-jw86-5cjf-mv79- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-jw86-5cjf-mv79
HTML Purifier allows remote attackers to obtain sensitive information
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
GHSA-jw86-5cjf-mv79- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2011-3744 No score
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
- Record
UBUNTU-CVE-2011-3744- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezyang/htmlpurifierPackagist |
through 4.2.0 | None known |
php-htmlpurifierUbuntu:16.04:LTS |
All versions, plus listed versions 4.6.0-14.7.0-14.7.0-1build1 |
None known |
php-htmlpurifierUbuntu:18.04:LTS |
All versions, plus listed versions 4.7.0-2 |
None known |
php-htmlpurifierUbuntu:20.04:LTS |
All versions, plus listed versions 4.10.0-14.11.0-1 |
None known |
php-htmlpurifierUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.0-1 |
None known |
php-htmlpurifierUbuntu:24.04:LTS |
All versions, plus listed versions 4.11.0-14.11.0-2 |
None known |
php-htmlpurifierUbuntu:25.10 |
All versions, plus listed versions 4.11.0-2 |
None known |
php-htmlpurifierUbuntu:26.10 |
All versions, plus listed versions 4.11.0-2build1 |
None known |
php-htmlpurifierUbuntu:26.04:LTS |
All versions, plus listed versions 4.11.0-24.11.0-2build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
code.google.com/p/inspathx/source/browse/trunk/paths_vuln/htmlpurifier-4.2.0
openwall.com/lists/oss-security/2011/06/27/6
nvd.nist.gov/vuln/detail/CVE-2011-3744
github.com/advisories/GHSA-jw86-5cjf-mv79
ubuntu.com/security/CVE-2011-3744
cve.org/CVERecord?id=CVE-2011-3744