HTTP_REDIRECT_STATUS variable manipulation can lead to arbitrary file inclusion in PHP

CVE-2024-8927

Summary

A security concern exists in specific versions of PHP where the HTTP_REDIRECT_STATUS variable can be manipulated via HTTP headers. This manipulation can prevent the cgi.force_redirect option from being applied correctly, potentially allowing unauthorized users to exploit this behavior for arbitrary file inclusion. Systems running PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12 may be affected, necessitating immediate action to update and secure installations.

References