How severe is CVE-2024-8927?

CVE-2024-8927 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-8927 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-8927?

CVE-2024-8927 affects Php. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-8927?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-8927 have an EU (EUVD) identifier?

Yes. CVE-2024-8927 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49490.

When was CVE-2024-8927 published?

CVE-2024-8927 was published on 2024-10-08 and last updated on 2026-06-17.

CVE-2024-8927

CVE-2024-8927 is a high-severity vulnerability in Php with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1220.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (61st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-49490
Weakness: CWE-1220
Affected product: Php
Published: 2024-10-08
Last modified: 2026-06-17

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

Frequently asked questions

What is CVE-2024-8927?: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
How severe is CVE-2024-8927?: CVE-2024-8927 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-8927 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-8927?: CVE-2024-8927 affects Php. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-8927?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-8927 have an EU (EUVD) identifier?: Yes. CVE-2024-8927 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49490.
When was CVE-2024-8927 published?: CVE-2024-8927 was published on 2024-10-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

More vulnerabilities in Php

CVE-2015-0235 — Critical (CVSS 10.0): Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
CVE-2012-2688 — Critical (CVSS 10.0): Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and…
CVE-2012-2376 — Critical (CVSS 10.0): Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to…
CVE-2011-3268 — Critical (CVSS 10.0): Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified…
CVE-2009-4143 — Critical (CVSS 10.0): PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1)…
CVE-2008-5557 — Critical (CVSS 10.0): Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0…

All CVEs affecting Php →

Other CWE-1220 vulnerabilities

CVE-2025-31201 — Critical (CVSS 9.8): This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS…
CVE-2022-2475 — Critical (CVSS 9.8): Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q…
CVE-2026-6356 — Critical (CVSS 9.6): A vulnerability in the web application allows standard users to escalate their privileges to those of a super…
CVE-2026-6388 — Critical (CVSS 9.1): A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify…
CVE-2025-8053 — Critical (CVSS 9.1): Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured…
CVE-2025-7493 — Critical (CVSS 9.1): A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to…

Browse all CWE-1220 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

41.205.23.59 (ipv4-addr)
152.89.64.17 (ipv4-addr)
45.177.210.193 (ipv4-addr)
39.164.91.67 (ipv4-addr)
122.3.106.113 (ipv4-addr)