CVE-2007-3997: PHP

High severity, CVSS 7.5. EPSS: 13.8% chance of exploitation in the next 30 days.

The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.

Affected products

• PHP PHP: from 4.0.0, before 4.4.8 (fixed in 4.4.8); from 5.0.0, before 5.2.4 (fixed in 5.2.4)

Published 2007-09-04. Last modified 2026-06-16.