SQL Injection in PHP due to Improper Escaping of Parameters
CVE-2026-17543

8.1HIGH

Key Information:

Vendor

PHP Group

Status
PHP
Vendor
CVE Published:
30 July 2026

What is CVE-2026-17543?

A vulnerability has been identified in specific versions of PHP where improper escaping of backslashes in input parameters may allow attackers to perform SQL injection attacks. This issue affects PHP versions 8.2.* prior to 8.2.33, 8.3.* prior to 8.3.33, 8.4.* prior to 8.4.24, and 8.5.* prior to 8.5.9, enabling potential unauthorized database access and manipulation.

Affected Version(s)

PHP 8.2.* < 8.2.33

PHP 8.3.* < 8.3.33

PHP 8.4.* < 8.4.24

References

https://github.com/php/php-src/security/advisories/GHSA-7...
vendor-advisory

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ExPatch-LLC
Alexandre Daubois - The PHP Foundation
Ilija Tovilo - The PHP Foundation
Matteo Beccati
Jakub Zelenka - The PHP Foundation
.