Skip to content
CVE IDCVE-2024-4577

Argument Injection in PHP-CGI

CVE-2024-4577 is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78), in github.com/php/php-src (Git repository). Affected versions: >= 8.1.0, < 8.1.29; >= 8.2.0, < 8.2.20; >= 8.3.0, < 8.3.8. It is fixed in 8.1.29, 8.2.20 or 8.3.8, depending on the release line. CISA lists it as a known exploited vulnerability (added 12 Jun 2024).

Critical9.8Known exploitedFix available

Published 9 Jun 2024Updated 21 Oct 2025

9.8CriticalCVSS 3.1
CVE ID
CVE-2024-4577
GHSA ID
No GitHub advisory
EPSS
99.98%higher than 99.9% of CVEs
Weakness (CWE)
  • CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
KEV status
Known exploitedAdded 12 Jun 2024
Published
9 Jun 2024
Updated
21 Oct 2025
Ecosystem
  • Git repositories
Assigned by (CNA)
php

Summary

Source: OSV (CVE record)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Technical details

Source: CVE.org

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Critical9.8Base score from CVE.org

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
High
Integrity I
High
Availability A
High

CISA SSVC decision points

Exploitation
active
Exploited in the wild
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by 3 Jul 2024. Used in ransomware campaigns.

Affected packages

Source: OSV (CVE record)

  • https://github.com/php/php-src
    Git repositories
    pkg:github/php/php-src
    Affected versions
    >= 8.1.0, < 8.1.29
    >= 8.2.0, < 8.2.20
    >= 8.3.0, < 8.3.8
    Fixed in
    8.1.29
    8.2.20
    8.3.8

Fix

Source: OSV (CVE record)

Fix available

Upgrade to 8.1.29, 8.2.20 or 8.3.8, depending on your release line.

Patch commits

  • #19247Pull requestgithub.com/rapid7/metasploit-framework

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • fc4973fRelease commit8.1.29github.com/php/php-src
  • 40298a9Release commit8.2.20github.com/php/php-src
  • ce51bfaRelease commit8.3.8github.com/php/php-src

Vulnerability intelligence

References

Credits

  • Orange Tsai, DEVCORE Research Teamreporter

Questions about CVE-2024-4577

What is the CVSS score of CVE-2024-4577?
CVE-2024-4577 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Which versions are affected by CVE-2024-4577?
https://github.com/php/php-src (GIT): >= 8.1.0, < 8.1.29; >= 8.2.0, < 8.2.20; >= 8.3.0, < 8.3.8.
How do I fix CVE-2024-4577?
Upgrade to 8.1.29, 8.2.20 or 8.3.8, depending on the release line. The fix is in pull request #19247.
What is the Package URL (PURL) for CVE-2024-4577?
The affected package's PURL is pkg:github/php/php-src.
Is CVE-2024-4577 exploited in the wild?
CISA lists it as a known exploited vulnerability (added 12 Jun 2024). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.98% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded
  • FIRST EPSSLoadedRaw JSON

Fetched 2 days ago (12 Oct 2026, 08:38 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (CVE record)
Severity score
CVE.org
Weakness (CWE)
OSV (CVE record)
Affected packages
OSV (CVE record)
Fix
OSV (CVE record)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
FIRST EPSS

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.