CVE-2026-7260

php: PHP: Denial of Service via circular symbolic links in phar archives

Publication Date 2026-07-30
Severity Moderate
Type Denial of Service
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.32
  • 8.3.0-8.3.32
  • 8.4.0-8.4.23
  • 8.5.0-8.5.8
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.7

CVE Details

Circular symbolic links in PHP Archive (PHAR) files could lead to an uncontrolled loop, exhausting the program's memory stack and crashing the PHP application in affected PHP versions. This vulnerability could allow an attacker to trigger a Denial of Service (DoS) condition, making the affected PHP service unavailable.

Recommendations

To mitigate this issue, avoid processing PHAR archives from untrusted sources. If the phar extension is not essential for your application, consider disabling it in the PHP configuration. Disabling the phar extension may impact applications that rely on it for legitimate archive handling.

If you rely on PHAR usage, you should consider upgrading to a version that patches the flaw.