CVE-2026-7260

Analyzed Analyzed - Analysis Complete

Stack Overflow in PHP Phar Archive Handling

Publication date: 2026-07-30

Last updated on: 2026-08-05

Assigner: PHP Group

Description

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-7260

EUVD

EUVD-2026-51092

Affected Vendors & Products

Vendor	Product	Version / Range
php	php	From 8.2.0 (inc) to 8.2.33 (exc)
php	php	From 8.3.0 (inc) to 8.3.33 (exc)
php	php	From 8.4.0 (inc) to 8.4.24 (exc)
php	php	From 8.5.0 (inc) to 8.5.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

CVE-2026-7260 is a stack overflow vulnerability in PHP's ext-phar extension. It occurs when processing phar archives with circular symbolic links, causing unbounded recursion without cycle detection. This exhausts the C stack and crashes the PHP process.

Detection Guidance

To detect this vulnerability, inspect PHP applications processing phar archives for circular symbolic links. Check PHP version against affected releases (before 8.2.33, 8.3.33, 8.4.24, 8.5.9). Use commands like 'php -v' to verify version and 'find /path -type l -exec ls -l {} \;' to identify circular symlinks in phar archives.

Impact Analysis

An attacker could exploit this by creating a malicious tar-based phar archive with circular symlinks. This would trigger a segmentation fault, crashing the PHP process. The attack requires local access but no privileges or user interaction.

Compliance Impact

This vulnerability causes PHP process crashes due to stack overflow from circular symbolic links in phar archives. While not directly related to data protection standards like GDPR or HIPAA, such crashes could disrupt systems handling sensitive data, potentially leading to service unavailability or data processing interruptions that may violate compliance requirements for availability and integrity.

Mitigation Strategies

Upgrade PHP to patched versions (8.2.33, 8.3.33, 8.4.24, or 8.5.9). Avoid processing untrusted phar archives. Implement input validation for phar files. Monitor PHP processes for crashes or stack overflow errors.

Hi! I’m here to help you understand CVE-2026-7260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70