CVE-2012-1172: PHP

Medium severity, CVSS 5.8. EPSS: 6.2% chance of exploitation in the next 30 days.

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.

Affected products

• PHP PHP: up to and including 5.3.10; version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only; …

Published 2012-05-24. Last modified 2026-06-16.