CVE-2026-17543

SQL injection via improper backslash escaping in Postgres

Publication Date 2026-07-30
Severity Critical
Type SQL Injection
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.32
  • 8.3.0-8.3.32
  • 8.4.0-8.4.23
  • 8.5.0-8.5.8
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.7

CVE Details

When using the Postgres extension, improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causing a denial of service.

Recommendations

Whenever possible, avoid using user-provided parameters with SQL queries. If you must, filter them prior to using them, and use parameterized queries (e.g. PDO::prepare() + PDOStatement::execute(), or use a query builder from a Database Abstraction Layer (DBAL) library such as Doctrine DBAL).

If you are using the Postgres extension, we recommend updating to a patched version immediately.