VULNERABILITY INTELLIGENCE
CVE-2007-0448
CVSS score10 HIGH
EPSS probability7.11%
CISA KEVNot currently listed
Published2007-05-24
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Description
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.