CVE-2011-0754

The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which…

published February 2, 2011

CVSS
—
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00339 · 25.9th percentile
Published
2011-02-02T21:00Z
EPSS history
Timeline
  • 02 FEB 21:00Z
    The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which…
    cvelistv5