Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Remediation
References
Related Vulnerabilities
WordPress Plugin Logo Carousel Cross-Site Scripting (1.7.1)
Oracle HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2022-25313)
Liferay Portal Incorrect Authorization Vulnerability (CVE-2021-33335)
MySQL CVE-2021-35640 Vulnerability (CVE-2021-35640)
WordPress Plugin TinyMCE Custom Styles Cross-Site Scripting (1.1.2)