CVE-2025-1220

score

<0.1

cvss

3.7

epss

0.6%

published

2025-07-13

kev added

—

first seen

2026-10-21

PHP 8.1.* < 8.1.33, 8.2.* < 8.2.29, 8.3.* < 8.3.23, and 8.4.* < 8.4.10 contain a security bypass caused by lack of null character validation in hostname for functions like fsockopen(), letting attackers bypass access checks relying on parse_url(), exploit requires user code to implement access checks using vulnerable functions.