CVE-2024-5585

score

<0.1

cvss

7.7

epss

28.8%

published

2024-06-09

kev added

—

first seen

2026-10-21

PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8 contain a command injection caused by insufficient escaping in proc_open() with array syntax, letting malicious users execute arbitrary commands on Windows, exploit requires attacker-controlled command arguments with trailing spaces.