CVE-2007-5899: The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute...

Security readout for executives and security teams

Older PHP versions could unintentionally send locally added form data, including session identifiers, to an external form destination. If an affected application rewrote forms this way, a third party receiving the form request could see sensitive values that were meant to stay local. Exposure is most likely in legacy PHP applications running PHP before 5.2.5 that use output_add_rewrite_var or related form/session rewriting and submit forms to external URLs. Modern supported PHP versions should not be assumed affected from these sources. Treat this as a legacy-platform cleanup item unless affected PHP versions are still present on internet-facing systems. Prioritize remediation where sessions, authentication, or customer data could be exposed to external form endpoints. Mitigation focus: Inventory any PHP runtimes older than 5.2.5.; Apply vendor PHP updates referenced by PHP or distribution advisories.; Check vendor guidance for supported backported fixes on legacy distributions..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.