CVE-2009-4143: PHP

High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days.

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive.

Affected products

• PHP PHP: up to and including 5.2.11; version 1.0 only; version 2.0 only; version 2.0b10 only; version 3.0 only; version 3.0.1 only; …

Published 2009-12-21. Last modified 2026-06-16.