Quick answers
- Is CVE-2026-7260 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7260 being exploited in the wild.
- How severe is CVE-2026-7260?
- Informational severity, with a CVSS score of 5.5, published 30 July 2026.
- Which products and versions are affected?
- PHP Group PHP 8.2.0 - 8.2.32, 8.3.0 - 8.3.32, 8.4.0 - 8.4.23, 8.5.0 - 8.5.8.
- Is there a fix for CVE-2026-7260?
- A patch was published on 2026-07-30: Fixed versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-7260 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-7260?
- Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The phar_get_link_source() function in ext/phar/util.c recursively follows symbolic links within Phar archives without implementing depth limits or cycle detection. An attacker can craft a tar-based Phar archive containing circular symbolic links (e.g., File A points to File B, which points back to File A). When PHP attempts to resolve these links, it enters an unbounded recursion that exhausts the C stack, resulting in a segmentation fault and process crash. This is exploitable if an application processes untrusted Phar or Tar files. Patches are available in PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
Affected products
- PHP Group PHP 8.2.0 - 8.2.32, 8.3.0 - 8.3.32, 8.4.0 - 8.4.23, 8.5.0 - 8.5.8
Timeline
- 2026-07-30: advisory: GHSA-vc5h-9ppw-p5f3 published by PHP Group
- 2026-07-30: patched: Fixed versions released