CVE-2004-2692: The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers t...

Security readout for executives and security teams

This is a legacy PHP hardening bypass. On systems using the php-exec-dir patch for PHP 4.3.2 through 4.3.7 with safe mode disabled, attackers could bypass command restrictions and run arbitrary commands. Exposure is likely limited to very old, customized PHP deployments. Likely exposure is narrow: legacy PHP 4.3.2-4.3.7 systems using the php-exec-dir patch, especially internet-facing applications with safe mode disabled. The source bundle does not identify packaged vendor products or modern CPEs. Prioritize if any legacy PHP 4 service remains in production or reachable from untrusted networks. If no php-exec-dir deployments exist, this is mainly a historical inventory concern. Mitigation focus: Inventory legacy PHP hosts for php-exec-dir and PHP 4.3.2-4.3.7.; Check the php-exec-dir project and vendor guidance for fixed versions or retirement advice.; Do not rely on php-exec-dir as the only command-execution control..

Prepared

Jun 29, 2026, 02:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.