CVE-2007-3230: PHP remote file inclusion vulnerability in phphtml.php in Idan Sofer PHP::HTML 0.6.4 allows remote attacker...

Security readout for executives and security teams

CVE-2007-3230 is a legacy PHP remote file inclusion flaw. If an exposed application uses Idan Sofer PHP::HTML 0.6.4, an attacker could make it load attacker-controlled PHP through the htmlclass_path parameter and run code on the server. Exposure is most likely in old PHP applications that bundled or deployed PHP::HTML 0.6.4 and still expose phphtml.php or reachable code paths using htmlclass_path. Prioritize discovery and removal if any legacy PHP estate remains internet-facing. Business urgency is high for exposed systems because the described impact is server-side code execution, but evidence does not confirm active exploitation. Mitigation focus: Inventory PHP applications for PHP::HTML 0.6.4 and phphtml.php.; Remove or replace the vulnerable component if it is still deployed.; Check original vendor and advisory guidance for any named fixed release..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.