---
id: CVE-2019-11045
title: >-
  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP
  DirectoryIterator class accepts filenames with embedded \0 byte and treats
  them as terminating at that byte
summary: >-
  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP
  DirectoryIterator class accepts filenames with embedded \0 byte and treats
  them as terminating at that byte. This could lead to security vulnerabilities,
  e.g. in appli…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-170
  - CWE-74
vendor: php
product: php
affected:
  - 'php >= 7.2.0, <= 7.2.26'
  - 'php >= 7.3.0, <= 7.3.13'
  - php = 7.4.0
  - fedora = 30
  - fedora = 31
  - debian_linux = 8.0
  - debian_linux = 9.0
  - debian_linux = 10.0
  - leap = 15.1
  - ubuntu_linux = 12.04
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.04
  - ubuntu_linux = 19.10
  - security_center < 5.19.0
patched:
  - security_center 5.19.0
published: '2019-12-23'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-11045'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html'
    label: security@php.net
  - url: 'https://bugs.php.net/bug.php?id=78863'
    label: security@php.net
  - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html'
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2020/Feb/27'
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2020/Feb/31'
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2021/Jan/3'
    label: security@php.net
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: security@php.net
  - url: 'https://usn.ubuntu.com/4239-1/'
    label: security@php.net
  - url: 'https://www.debian.org/security/2020/dsa-4626'
    label: security@php.net
  - url: 'https://www.debian.org/security/2020/dsa-4628'
    label: security@php.net
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: security@php.net
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.php.net/bug.php?id=78863'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2020/Feb/27'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2020/Feb/31'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2021/Jan/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4239-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4626'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4628'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.08818
epssPercentile: 0.95012
ingestedAt: '2026-08-17T14:55:58.817Z'
---

## Overview

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

## Affected

- `php >= 7.2.0, <= 7.2.26`
- `php >= 7.3.0, <= 7.3.13`
- `php = 7.4.0`
- `fedora = 30`
- `fedora = 31`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `debian_linux = 10.0`
- `leap = 15.1`
- `ubuntu_linux = 12.04`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.04`
- `ubuntu_linux = 19.10`
- `security_center < 5.19.0`

## Remediation

Upgrade past the affected range:

- `security_center 5.19.0`