Platform
php
Component
php
Fixed in
7.2.26
7.3.13
7.4.1
CVE-2019-11045 is a security vulnerability affecting PHP's DirectoryIterator class. The flaw arises from the class's failure to properly handle filenames containing embedded null bytes (\0). This allows attackers to potentially bypass path validation checks and access files outside of intended directories. Versions of PHP 7.2.x prior to 7.2.26, 7.3.x prior to 7.3.13, and 7.4.0 are vulnerable. The vulnerability is resolved in PHP 7.4.1.
An attacker can exploit CVE-2019-11045 to read arbitrary files on the server if the application uses the DirectoryIterator class to process user-supplied filenames without proper sanitization. This could include sensitive configuration files, source code, or even database credentials. The attack typically involves crafting a filename containing a null byte followed by a path to the desired file. For example, a malicious user could provide a filename like 'image.jpg%00/etc/passwd' to the application. The DirectoryIterator would interpret the filename as 'image.jpg' and then attempt to access '/etc/passwd', potentially exposing the contents of the file. The blast radius depends on the application's permissions and the files it processes; a web application with broad file access could be severely compromised. While not directly comparable to Log4Shell, it shares the characteristic of allowing an attacker to bypass intended access controls through crafted input.
CVE-2019-11045 was published on December 23, 2019. The CVSS score is LOW (3.7). There are currently no known public exploits or active campaigns targeting this vulnerability. It is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog or EPSS. While the EPSS score is likely low, diligent patching is still recommended to prevent potential exploitation.
Exploit Status
EPSS
41.48% (97% percentile)
CVSS Vector
The primary mitigation for CVE-2019-11045 is to upgrade to a patched version of PHP. Upgrade to PHP 7.4.1 or later to eliminate the vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all filenames processed by the DirectoryIterator class. Specifically, strip or reject filenames containing null bytes. Web application firewalls (WAFs) can be configured to detect and block requests containing suspicious filenames. Implement strict file access controls to limit the impact of a potential breach. After upgrading, confirm the fix by attempting to access a sensitive file using a crafted filename containing a null byte; the access should be denied.
Update to the latest version of PHP. If you cannot update immediately, ensure that your application does not rely on filenames provided by the user without proper validation. Validate and sanitize file paths before using them with the DirectoryIterator class.
Vulnerability analysis and critical alerts directly to your inbox.
It's a directory traversal vulnerability in PHP's DirectoryIterator class, allowing attackers to access files outside intended directories by exploiting improper null byte handling.
You are vulnerable if you are running PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, or 7.4.0.
Upgrade to PHP 7.4.1 or later. If upgrading isn't possible, sanitize filenames to remove null bytes.
Currently, there are no known public exploits or active campaigns targeting this vulnerability.
Refer to the official CVE entry on the NVD website: https://nvd.nist.gov/vuln/detail/CVE-2019-11045
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.