Every CVE Search/ Get API key

CVE-2024-5585

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

7.7 HighFix available

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

28.8%Up 28.8 points since Jun 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.7

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
CVE-2024-5585
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-116, CWE-78
Updated
2026-11-02
EUVDEUVD-2024-46774 7.7

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
EUVD-2024-46774
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
NVD 7.7

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
CVE-2024-5585
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-116
Updated
2026-11-02
OSVALPINE-CVE-2024-5585 8.8

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
ALPINE-CVE-2024-5585
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-42427 8.8

CVE-2024-5585 affecting package php for versions less than 8.1.29-1

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
AZL-42427
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-42439 8.8

CVE-2024-5585 affecting package php for versions less than 8.3.8-1

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
AZL-42439
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 5 moreShow less
OSVBELL-CVE-2024-5585 8.8

CVE-2024-5585 does not affect BellSoft software

Record
BELL-CVE-2024-5585
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.7

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
CVE-2024-5585
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-116, CWE-78
Updated
2026-11-02
OSVBIT-libphp-2024-5585 No score

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
BIT-libphp-2024-5585
Updated
2026-11-02
OSVBIT-php-2024-5585 No score

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
BIT-php-2024-5585
Updated
2026-11-02
OSVBIT-php-min-2024-5585 No score

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Record
BIT-php-min-2024-5585
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php81
Alpine:v3.19
 before 8.1.29-r0
8.1.29-r0
php82
Alpine:v3.19
 before 8.2.20-r0
8.2.20-r0
php83
Alpine:v3.19
 before 8.3.8-r0
8.3.8-r0
php
Azure Linux:2
 before 8.1.29-1
8.1.29-1
php
Azure Linux:3
 before 8.3.8-1
8.3.8-1
libphp
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8
php
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8
php-min
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8

History

History
RecordedChangedSources
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-5585 is a high vulnerability (CVSS 7.7) in Php, published June 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 28.8%, the 98th percentile. Fixed in php81 8.1.29-r0.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open