A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1786573]
Upstream patch for this issue:
There's an issue with SPL PHP extension on spl_filesystem_object_construct() function. When creating a new DirectoryIterator() object spl_filesystem_object_construct() function is called and use zend to parse its arguments with the wrong parameter type specifier, this bug leads the zend_parse_parameters() to interprete the parameter as a simple string instead of a filesystem path. An attacker may leverage this by crafting a path name containing NULL bytes which will be badly parsed, allowing the attacker eventually by pass any path-based security validation or listing documents from a unexpected directory.
This flaw has a high Confidentiality impact as the actor may eventually seen the filesystem tree from the attacked machine but a high complexity as the attacker may need to have previous knowledge of filesystem organization or trick the user to run the malicious script.