CVE-2021-21707

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-159

Affected software

Vendor	Product	Versions
PHP Group	PHP	>= 7.3.x, < 7.3.33; >= 7.4.x, < 7.4.26; >= 8.0.X, < 8.0.13

References

https://bugs.php.net/bug.php?id=79971Exploit, Issue Tracking, Patch, Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.htmlIssue Tracking, Mailing List
https://security.netapp.com/advisory/ntap-20211223-0005/Third Party Advisory
https://www.debian.org/security/2022/dsa-5082Third Party Advisory
https://www.tenable.com/security/tns-2022-09Patch, Release Notes, Third Party Advisory
https://bugs.php.net/bug.php?id=79971Exploit, Issue Tracking, Patch, Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.htmlIssue Tracking, Mailing List
https://security.netapp.com/advisory/ntap-20211223-0005/Third Party Advisory
https://www.debian.org/security/2022/dsa-5082Third Party Advisory
https://www.tenable.com/security/tns-2022-09Patch, Release Notes, Third Party Advisory

Timeline

Published: Nov 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217089.8In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter CVE-2021-21714.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 CVE-2021-21726.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prio CVE-2021-217224.4A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulne CVE-2021-217237.5Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can CVE-2021-217244.4A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attack CVE-2021-217255.7A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in othe CVE-2021-217262.3Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some pa CVE-2021-217277.5A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected d CVE-2021-217285.3A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing CVE-2021-217296.5Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authoriza CVE-2021-21734.1Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.