CVE-2015-6833: PHP

High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.

Affected products

• PHP PHP: up to and including 5.4.43; version 5.5.0 only; version 5.5.1 only; version 5.5.2 only; version 5.5.3 only; version 5.5.4 only; …

Published 2016-01-19. Last modified 2026-06-17.