Vulnerabilities/PHP Group/CVE-2024-4577
CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 12 Jun 2024
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 3 Jul 2024 · CWE-78
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | 8.1.* to before 8.1.29 | Unknown |
| PHP | 8.2.* to before 8.2.20 | Unknown |
| PHP | 8.3.* to before 8.3.8 | Unknown |
| php | 8.1.0 to before 8.1.29 | Unknown |
| php | 8.2.0 to before 8.2.20 | Unknown |
Show 1 more rows
| php | 8.3.0 to before 8.3.8 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 12 Jun 2024 · Added to CISA KEV
- 3 Jul 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.