CVE-2007-4850: PHP

Medium severity, CVSS 5.0. EPSS: 5.6% chance of exploitation in the next 30 days.

curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.

Affected products

• PHP PHP: version 5.2.4 only; version 5.2.5 only

Published 2008-01-25. Last modified 2026-06-16.