---
id: CVE-2019-11044
title: >-
  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows,
  PHP link() function accepts filenames with embedded \0 byte and treats them as
  terminating at that byte
summary: >-
  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows,
  PHP link() function accepts filenames with embedded \0 byte and treats them as
  terminating at that byte. This could lead to security vulnerabilities, e.g. in
  ap…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-170
vendor: php
product: php
affected:
  - 'php >= 7.2.0, <= 7.2.26'
  - 'php >= 7.3.0, <= 7.3.13'
  - php = 7.4.0
  - security_center < 5.19.0
  - fedora = 30
  - fedora = 31
patched:
  - security_center 5.19.0
published: '2019-12-23'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-11044'
references:
  - url: 'https://bugs.php.net/bug.php?id=78862'
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: security@php.net
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: security@php.net
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: security@php.net
  - url: 'https://bugs.php.net/bug.php?id=78862'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.05124
epssPercentile: 0.92008
ingestedAt: '2026-08-17T14:55:58.781Z'
---

## Overview

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

## Affected

- `php >= 7.2.0, <= 7.2.26`
- `php >= 7.3.0, <= 7.3.13`
- `php = 7.4.0`
- `security_center < 5.19.0`
- `fedora = 30`
- `fedora = 31`

## Remediation

Upgrade past the affected range:

- `security_center 5.19.0`