# CVE-1999-0058: PHP php.cgi buffer overflow allows shell access

Source: https://junglewise.ai/threats/cve-1999-0058-php-php-cgi-buffer-overflow-allows-shell-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-04-17. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0058 · Severity: high · CVSS 7.5 · Published 1997-04-17

A critical security flaw was identified in the PHP CGI program that could allow an unauthorized person to gain remote access to a web server's command shell. PHP is a widely used scripting language for web development, and this component handles how scripts interact with the server. An attacker exploiting this could take full control of the server, potentially leading to data theft, website defacement, or complete service disruption.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-1999-0058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0058 being exploited in the wild.

**How severe is CVE-1999-0058?** High severity, with a CVSS score of 7.5, published 17 April 1997.

**Which products and versions are affected?** PHP Group PHP Versions prior to 1997-04-17.

**Is there a fix for CVE-1999-0058?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0058 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-1999-0058?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the php.cgi component of early PHP implementations. The flaw is triggered when the CGI program processes maliciously crafted input, leading to memory corruption. A remote, unauthenticated attacker can exploit this by sending a specific request to the web server, allowing for arbitrary code execution with the privileges of the web server process. This typically results in the attacker gaining interactive shell access. Users should ensure they are using modern, patched versions of PHP as this issue affects legacy CGI configurations.

## Affected products

- PHP Group PHP Versions prior to 1997-04-17

## Timeline

- 1997-04-17: disclosed: Initial publication date of the vulnerability.

## References

- [http://www.securityfocus.com/bid/712](http://www.securityfocus.com/bid/712)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)