CVE-2009-3557: The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-depe...

Security readout for executives and security teams

CVE-2009-3557 is an old PHP flaw where the tempnam function could let an attacker bypass PHP safe_mode limits and create files in writable directories. It affects PHP before 5.2.12 and PHP 5.3.x before 5.3.1. Business urgency is mainly for legacy systems still running these versions. Exposure is likely limited to legacy PHP deployments using versions earlier than 5.2.12 or 5.3.1, especially applications relying on safe_mode as a security boundary. Modern PHP installations are unlikely to be affected by this specific safe_mode issue. Treat this as a legacy-risk cleanup item unless affected PHP versions are internet-facing or business-critical. Prioritize replacement or upgrade of unsupported PHP stacks, because their broader security exposure likely exceeds this single CVE. Mitigation focus: Upgrade affected PHP to 5.2.12, 5.3.1, or a supported later version.; Identify and retire applications depending on PHP safe_mode for isolation.; Review vendor or operating-system advisories for packaged PHP backports..

Prepared

Jun 28, 2026, 15:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.