In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
This flaw is present in the file ext/standard/link_win32.c, which is compiled only on Windows builds.
Similar code is present in ext/standard/link.c and there was a similar flaw there in the past, named CVE-2006-7243. This was however fixed in the versions of php we ship.
This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as the flaw only affects Windows builds. See CVE-2006-7243 for the Linux version of this flaw.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):