CVE-2007-5447: Ioncube PHP Encoder

Medium severity, CVSS 4.3. EPSS: 4.6% chance of exploitation in the next 30 days.

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.

Affected products

• Ioncube PHP Encoder: version 6.5 only
• PHP PHP: version 5.2.4 only

Published 2007-10-14. Last modified 2026-06-16.