Circular Symbolic Link Vulnerability in PHP by The PHP Group
CVE-2026-7260

5.4MEDIUM

Key Information:

Vendor: PHP Group
Status: PHP
Vendor: CVE Published:; 30 July 2026

What is CVE-2026-7260?

A vulnerability exists in PHP that allows for the creation of circular symbolic links within phar archives. This can lead to unbounded recursion, exhausting the C stack and potentially crashing the PHP process. This issue affects multiple PHP versions prior to their respective updates, exposing applications to reliability risks and potential downtime.

Affected Version(s)

PHP 8.2.* < 8.2.33

PHP 8.3.* < 8.3.33

PHP 8.4.* < 8.4.24

References

https://github.com/php/php-src/security/advisories/GHSA-v...

vendor-advisory

CVSS V4

Score:

5.4

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
Apr 28, 2026

Credit

Calvin Young - eWalker Consulting (HK) Limited

Enoch Chow - Isomorph Cyber

Jakub Zelenka - The PHP Foundation

CVE-2026-7260 Data

JSON