Bug 2468562 (CVE-2026-6735) - CVE-2026-6735 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation
Summary: CVE-2026-6735 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via i...
Keywords:
Status: NEW
Alias: CVE-2026-6735
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-10 05:01 UTC by OSIDB Bzimport
Modified: 2026-07-01 16:50 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:22142 0 None None None 2026-06-01 03:05:45 UTC
Red Hat Product Errata RHSA-2026:22143 0 None None None 2026-06-01 02:47:16 UTC
Red Hat Product Errata RHSA-2026:22305 0 None None None 2026-06-01 10:53:51 UTC
Red Hat Product Errata RHSA-2026:22649 0 None None None 2026-06-02 22:08:05 UTC
Red Hat Product Errata RHSA-2026:23388 0 None None None 2026-06-04 15:53:46 UTC
Red Hat Product Errata RHSA-2026:33449 0 None None None 2026-06-30 10:46:07 UTC
Red Hat Product Errata RHSA-2026:34354 0 None None None 2026-07-01 16:50:00 UTC

Description OSIDB Bzimport 2026-05-10 05:01:14 UTC 
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Comment 2 errata-xmlrpc 2026-06-01 02:47:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22143 https://access.redhat.com/errata/RHSA-2026:22143
Comment 3 errata-xmlrpc 2026-06-01 03:05:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22142 https://access.redhat.com/errata/RHSA-2026:22142
Comment 4 errata-xmlrpc 2026-06-01 10:53:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:22305 https://access.redhat.com/errata/RHSA-2026:22305
Comment 5 errata-xmlrpc 2026-06-02 22:08:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:22649 https://access.redhat.com/errata/RHSA-2026:22649
Comment 6 errata-xmlrpc 2026-06-04 15:53:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:23388 https://access.redhat.com/errata/RHSA-2026:23388
Comment 7 errata-xmlrpc 2026-06-30 10:46:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:33449 https://access.redhat.com/errata/RHSA-2026:33449
Comment 8 errata-xmlrpc 2026-07-01 16:49:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:34354 https://access.redhat.com/errata/RHSA-2026:34354
Note You need to log in before you can comment on or make changes to this bug.