CVE-2019-11044: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Affected products

• Fedoraproject Fedora: version 30 only; version 31 only
• PHP PHP: from 7.2.0, up to and including 7.2.26; from 7.3.0, up to and including 7.3.13; version 7.4.0 only
• Tenable Security Center: before 5.19.0 (fixed in 5.19.0)

Published 2019-12-23. Last modified 2026-08-17.