CVE-2012-2335: PHP

High severity, CVSS 7.5. EPSS: 32.2% chance of exploitation in the next 30 days.

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.

Affected products

• PHP PHP: version 5.3.12 only; version 5.4.2 only

Published 2012-05-11. Last modified 2026-06-16.