CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. | Php · Archive Tar | Likely | – | 73% | 2021-07-27 |
| CVE-2008-2666Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and… | Php · Php | Likely | – | 14% | 2008-06-20 |
| CVE-2015-6833Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via… | Php · Php | Possible | – | 4.8% | 2016-01-19 |
| CVE-2014-9767Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip… | Php · Php | Possible | – | 4.7% | 2016-05-22 |
| CVE-2008-5658Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a… | Php · Php | Possible | – | 4.0% | 2008-12-17 |
| CVE-2007-4825Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl fu… | Php · Php | Possible | – | 3.4% | 2007-09-12 |
| CVE-2008-2665Directory traversal vulnerability in the posix_access function in PHP 5.2.6 and earlier allows remote attackers to bypass safe_mode restrictions via a .. (dot dot) in an http URL,… | Php · Php | Possible | – | 3.4% | 2008-06-20 |
| CVE-2007-4663Directory traversal vulnerability in PHP before 5.2.4 allows attackers to bypass open_basedir restrictions via unspecified vectors involving the glob function. | Php · Php | Possible | – | 2.1% | 2007-09-04 |
| CVE-2021-21706ZipArchive::extractTo may extract outside of destination dir | PHP Group · PHP | Possible | 5.3 | 1.5% | 2021-10-04 |
| CVE-2014-3981acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. | Php · Php | Unlikely | – | 0.8% | 2014-06-08 |
| CVE-2014-5459The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file i… | Php · Php | Unlikely | – | 0.6% | 2014-09-27 |
| CVE-2007-4652The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink. | Php · Php | Unlikely | – | 0.6% | 2007-09-04 |
| CVE-2011-1072The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3… | Php · Pear | Unlikely | – | 0.5% | 2011-03-03 |
| CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | PHP Group · PHP | Unlikely | 6.9 | 0.4% | 2026-09-25 |
| CVE-2011-0754The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier fo… | Php · Php | Unlikely | – | 0.3% | 2011-02-02 |
| CVE-2011-0441The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/. | Php · Php | Unlikely | – | 0.3% | 2011-03-29 |
| CVE-2011-1144The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_di… | Php · Pear | Unlikely | – | 0.3% | 2011-03-03 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.