CVE-2007-4889: PHP MySQL Extension

Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe_mode and open_basedir restrictions via the MySQL (1) LOAD_FILE, (2) INTO DUMPFILE, and (3) INTO OUTFILE functions, a different issue than CVE-2007-3997.

Affected products

• PHP MySQL Extension: any version
• PHP PHP: up to and including 5.2.4

Published 2007-09-14. Last modified 2026-06-16.