CVE-2024-1874 CRITICAL

CVE-2024-1874: Command injection via array-ish $command parameter of proc_open()

Vendor Php Group
Product PHP
Weakness CWE-116
Published April 29, 2024
Last update November 4, 2025
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Key dates

02Disclosure timeline

April 29, 2024 CVE published
November 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32974 org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type CVE-2021-32796 Misinterpretation of malicious XML input in xmldom CVE-2026-34481 Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab CVE-2025-40547 SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability