{"id":"CVE-2024-4577","aliases":["ALPINE-CVE-2024-4577","AZL-42424","AZL-42433","BELL-CVE-2024-4577","BIT-libphp-2024-4577","BIT-php-2024-4577","BIT-php-min-2024-4577","EUVD-2024-44188","GHSA-3qgc-jrrr-25jv","GHSA-vxpp-6299-mxw3","openSUSE-SU-2024:14376-1"],"status":"published","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.99987,"percentile":0.99984,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2024-06-09T19:42:36Z","modified":"2026-11-05T05:40:51Z","kev":{"date_added":"2024-06-12","due_date":"2024-07-03","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-06-12"},{"source":"kev","since":"2024-06-12"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577","title":"PHP CGI Argument Injection Remote Code Execution","type":"exploit","platform":"PHP,Windows","date":"2024-06-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577"},{"source":"pocgithub","id":"11whoami99/CVE-2024-4577","title":"11whoami99/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/11whoami99/CVE-2024-4577"},{"source":"pocgithub","id":"Ra1n-60W/CVE-2024-4577","title":"Ra1n-60W/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/Ra1n-60W/CVE-2024-4577"},{"source":"pocgithub","id":"Sysc4ll3r/CVE-2024-4577","title":"Sysc4ll3r/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/Sysc4ll3r/CVE-2024-4577"},{"source":"pocgithub","id":"TAM-K592/CVE-2024-4577","title":"TAM-K592/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/TAM-K592/CVE-2024-4577"},{"source":"pocgithub","id":"WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP","title":"WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP","date":"2024-06-07","url":"https://github.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP"},{"source":"pocgithub","id":"graphite-org/CVE-2024-4577","title":"graphite-org/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/graphite-org/CVE-2024-4577"},{"source":"pocgithub","id":"huseyinstif/CVE-2024-4577-Nuclei-Template","title":"huseyinstif/CVE-2024-4577-Nuclei-Template","date":"2024-06-07","url":"https://github.com/huseyinstif/CVE-2024-4577-Nuclei-Template"},{"source":"pocgithub","id":"princew88/CVE-2024-4577","title":"princew88/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/princew88/CVE-2024-4577"},{"source":"pocgithub","id":"taida957789/CVE-2024-4577","title":"taida957789/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/taida957789/CVE-2024-4577"},{"source":"pocgithub","id":"watchtowrlabs/CVE-2024-4577","title":"watchtowrlabs/CVE-2024-4577","date":"2024-06-07","url":"https://github.com/watchtowrlabs/CVE-2024-4577"},{"source":"pocgithub","id":"0x20c/CVE-2024-4577-nuclei","title":"0x20c/CVE-2024-4577-nuclei","date":"2024-06-08","url":"https://github.com/0x20c/CVE-2024-4577-nuclei"},{"source":"pocgithub","id":"ZephrFish/CVE-2024-4577-PHP-RCE","title":"ZephrFish/CVE-2024-4577-PHP-RCE","date":"2024-06-08","url":"https://github.com/ZephrFish/CVE-2024-4577-PHP-RCE"},{"source":"pocgithub","id":"manuelinfosec/CVE-2024-4577","title":"manuelinfosec/CVE-2024-4577","date":"2024-06-08","url":"https://github.com/manuelinfosec/CVE-2024-4577"},{"source":"pocgithub","id":"xcanwin/CVE-2024-4577-PHP-RCE","title":"xcanwin/CVE-2024-4577-PHP-RCE","date":"2024-06-08","url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE"},{"source":"pocgithub","id":"zomasec/CVE-2024-4577","title":"zomasec/CVE-2024-4577","date":"2024-06-08","url":"https://github.com/zomasec/CVE-2024-4577"},{"source":"pocgithub","id":"Chocapikk/CVE-2024-4577","title":"Chocapikk/CVE-2024-4577","date":"2024-06-09","url":"https://github.com/Chocapikk/CVE-2024-4577"},{"source":"pocgithub","id":"dbyMelina/CVE-2024-4577","title":"dbyMelina/CVE-2024-4577","date":"2024-06-09","url":"https://github.com/dbyMelina/CVE-2024-4577"},{"source":"pocgithub","id":"BLACK-ARCHIVERS/CVE-2024-4577","title":"BLACK-ARCHIVERS/CVE-2024-4577","date":"2024-06-11","url":"https://github.com/BLACK-ARCHIVERS/CVE-2024-4577"},{"source":"pocgithub","id":"bl4cksku11/CVE-2024-4577","title":"bl4cksku11/CVE-2024-4577","date":"2024-06-11","url":"https://github.com/bl4cksku11/CVE-2024-4577"},{"source":"pocgithub","id":"0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE","title":"0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE","date":"2024-06-12","url":"https://github.com/0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE"},{"source":"pocgithub","id":"Entropt/CVE-2024-4577_Analysis","title":"Entropt/CVE-2024-4577_Analysis","date":"2024-06-12","url":"https://github.com/Entropt/CVE-2024-4577_Analysis"},{"source":"pocgithub","id":"aavamin/cve-2024-4577","title":"aavamin/cve-2024-4577","date":"2024-06-12","url":"https://github.com/aavamin/cve-2024-4577"},{"source":"pocgithub","id":"d3ck4/Shodan-CVE-2024-4577","title":"d3ck4/Shodan-CVE-2024-4577","date":"2024-06-12","url":"https://github.com/d3ck4/Shodan-CVE-2024-4577"},{"source":"pocgithub","id":"Sh0ckFR/CVE-2024-4577","title":"Sh0ckFR/CVE-2024-4577","date":"2024-06-13","url":"https://github.com/Sh0ckFR/CVE-2024-4577"},{"source":"pocgithub","id":"gotr00t0day/CVE-2024-4577","title":"gotr00t0day/CVE-2024-4577","date":"2024-06-15","url":"https://github.com/gotr00t0day/CVE-2024-4577"},{"source":"exploitdb","id":"EDB-52331","title":"PHP CGI Module 8.3.4 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2025-06-15","url":"https://www.exploit-db.com/exploits/52331"},{"source":"nuclei","id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml"}],"exploits_more":48,"fixes":[{"ecosystem":"Alpine:v3.19","package":"php81","fixed_in":["8.1.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"php82","fixed_in":["8.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"php83","fixed_in":["8.3.8-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"php","fixed_in":["8.1.29-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"php","fixed_in":["8.3.8-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["8.1.29","8.2.20","8.3.8"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["8.1.29","8.2.20","8.3.8"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["8.1.29","8.2.20","8.3.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"php81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"php82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.29-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.8-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.12-1.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"php_group","product":"php"}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","tags":["x_transferred","Exploit","Third Party Advisory","advisory"]},{"url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","tags":["x_transferred","Third Party Advisory","advisory","article"]},{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","tags":["x_transferred","Exploit","Third Party Advisory","advisory","article"]},{"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/","tags":["x_transferred","Exploit","Press/Media Coverage","Third Party Advisory","advisory","web"]},{"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","tags":["x_transferred","Third Party Advisory","advisory","article"]},{"url":"https://github.com/11whoami99/CVE-2024-4577","tags":["x_transferred","Exploit","evidence","package"]},{"url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","tags":["x_transferred","Exploit","Third Party Advisory","advisory","package"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/19247","tags":["x_transferred","Exploit","Issue Tracking","Patch","fix"]},{"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/watchtowrlabs/CVE-2024-4577","tags":["x_transferred","Exploit","Third Party Advisory","advisory","package"]},{"url":"https://www.php.net/ChangeLog-8.php#8.1.29","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://www.php.net/ChangeLog-8.php#8.2.20","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://www.php.net/ChangeLog-8.php#8.3.8","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://isc.sans.edu/diary/30994","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/07/1","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0008/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577","tags":["government-resource","US Government Resource","web"]},{"url":"https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577","tags":["Exploit","Third Party Advisory","advisory","web"]},{"url":"https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577","tags":["Exploit","Third Party Advisory","advisory","web"]},{"url":"https://blog.talosintelligence.com/new-persistent-attacks-japan/","tags":["Exploit","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4577","tags":["web","advisory"]},{"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers"},{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en"},{"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577"},{"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK"},{"url":"https://security.netapp.com/advisory/ntap-20240621-0008"},{"url":"https://blog.talosintelligence.com/new-persistent-attacks-japan"},{"url":"https://github.com/advisories/GHSA-vxpp-6299-mxw3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-4577","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-4577","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4577.json","tags":["advisory"]},{"url":"https://github.com/php/php-src","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RM3WP4ENMVRYGM7IU7L7DTX3KTTN5UHE/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9026","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-4577","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T19:42:36.464Z","modified":"2025-10-21T23:05:16.089Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:16.78507Z"}],"euvd":[{"id":"EUVD-2024-44188","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T19:42:36Z","modified":"2025-10-21T23:05:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-06-12","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-vxpp-6299-mxw3","title":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache...","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T21:30:34Z","modified":"2025-10-22T00:34:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2024-4577","title":"PHP-CGI OS Command Injection Vulnerability","description":"PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.","cwes":["CWE-78"],"kev":{"date_added":"2024-06-12","due_date":"2024-07-03","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-4577","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T20:15:09.55Z","modified":"2026-06-17T08:02:11.493Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"ALPINE-CVE-2024-4577","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T20:15:09.55Z","modified":"2026-11-03T06:32:09.111449541Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-42424","title":"CVE-2024-4577 affecting package php for versions less than 8.1.29-1","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T20:15:09Z","modified":"2026-04-21T04:29:32.571936Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42433","title":"CVE-2024-4577 affecting package php for versions less than 8.3.8-1","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T20:15:09Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"BELL-CVE-2024-4577","title":"CVE-2024-4577 does not affect BellSoft software","status":"withdrawn","published":"2024-06-12T05:57:14.87833Z","modified":"2026-01-26T09:46:22.143705Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"CVE-2024-4577","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-09T19:42:36.464Z","modified":"2026-10-28T02:31:03.234315892Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"BIT-libphp-2024-4577","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2025-08-11T13:54:18.697Z","modified":"2026-09-08T08:48:08.508445603Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2024-4577","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2024-06-12T07:30:56.913Z","modified":"2026-09-08T08:48:18.219697162Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2024-4577","title":"Argument Injection in PHP-CGI","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","status":"published","published":"2025-01-14T19:19:35.322Z","modified":"2026-09-08T08:48:18.125503435Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"openSUSE-SU-2024:14376-1","title":"php8-8.3.12-1.1 on GA media","description":"These are all security issues fixed in the php8-8.3.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-29T00:00:00Z","modified":"2026-02-04T04:39:50.629439Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}