Vulnerability record · CVE-2018-5712 · published 16 January 2018
CVE-2018-5712: PHP PHAR 404 page reflected XSS via request URI
Php · Php
PHP versions before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13 and 7.2.x before 7.2.1 reflect the request URI unescaped on the PHAR 404 error page when a .phar file is requested. An attacker who can get a victim to follow a crafted link can run script in the victim's browser in the context of the affected site. The record does not list specific affected distributions beyond PHP, Debian Linux and Ubuntu Linux.
Description
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Automated analysis
medium priorityReflected XSS requires user interaction and yields limited confidentiality and integrity impact, but the affected PHP versions are widely deployed and EPSS is very high.
What it is
PHP versions before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13 and 7.2.x before 7.2.1 reflect the request URI unescaped on the PHAR 404 error page when a .phar file is requested. An attacker who can get a victim to follow a crafted link can run script in the victim's browser in the context of the affected site. The record does not list specific affected distributions beyond PHP, Debian Linux and Ubuntu Linux.
Impact
An attacker gains script execution in the victim's browser session on the vulnerable origin, enabling theft of session cookies or other data reachable from that page and actions performed as the victim. The CVSS scope change (S:C) reflects impact beyond the vulnerable component.
Attack surface
Reached over the network by requesting a .phar file whose URI contains the payload; no authentication is required, but the victim must be induced to click a crafted link (UI:R). The flaw is in the PHAR 404 error page handling.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.79949, 99.59th percentile), and references include vendor advisories, a PHP bug report tagged Patch, and distro errata, but no public exploit reference is given.
What to do
- Upgrade PHP to 5.6.33, 7.0.27, 7.1.13, 7.2.1 or later; apply the referenced Debian, Ubuntu and Red Hat errata.
- If immediate upgrade is not possible, restrict or disable serving of .phar files through the web server.
- Deploy a WAF rule that blocks script payloads in request URIs targeting .phar paths.
- Set session cookies HttpOnly and SameSite to limit theft via injected script.
- Track vendor advisories for the affected PHP branches and confirm the installed version against the fixed releases.
Detection
- Search web and proxy logs for requests to .phar paths whose URI contains script tags, event handlers or encoded angle brackets.
- Alert on 404 responses for .phar requests with unusual query strings or path segments.
- Review PHP error logs for PHAR 404 handling entries tied to suspicious request URIs.
- Monitor for outbound or injected script patterns on pages served from PHP hosts running unpatched versions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-5712 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-5712), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
