XSS Vulnerability in PHP-FPM Status Page Affects PHP Versions

CVE-2026-6735

What is CVE-2026-6735?

An XSS vulnerability exists in the PHP-FPM status page across multiple PHP versions, stemming from inadequate sanitization of user-provided data. This weakness allows attackers to craft a malicious URL that, when accessed by a user, can trigger the execution of arbitrary JavaScript on their machine, leading to potential data breaches or compromise. It is critical for users of affected PHP versions, particularly in environments where the PHP-FPM status page is accessible, to apply necessary updates and mitigate this risk.

References