CVE-2021-21707

score

<0.1

cvss

5.3

epss

25.3% ▼0.6

published

2021-11-29

kev added

—

first seen

2026-10-21

PHP versions 7.3.x < 7.3.33, 7.4.x < 7.4.26, and 8.0.x < 8.0.13 contain an XML parsing vulnerability caused by URL-decoding filenames in functions like simplexml_load_file(), letting attackers craft filenames with URL-encoded NUL characters to read unintended files, exploit requires attacker to control filename input.