CVE-2009-4017: PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handl...

Security readout for executives and security teams

This is an old PHP vulnerability where specially formed file-upload web requests can create too many temporary files. An attacker could exhaust server resources and disrupt web services. It also may make separate local file inclusion flaws easier to abuse. It affects PHP before 5.2.12 and PHP 5.3.x before 5.3.1. Exposure is most likely on legacy web servers running PHP versions earlier than 5.2.12 or PHP 5.3.0. Internet-facing upload forms or endpoints accepting multipart/form-data requests are the highest concern. Modern supported PHP versions should not be affected by this specific flaw. Prioritize remediation if any legacy PHP servers remain internet-facing, especially with upload functionality. For current PHP platforms, this is mainly a legacy exposure check. The business risk is service disruption rather than direct data theft, unless paired with separate file inclusion vulnerabilities. Mitigation focus: Upgrade PHP to 5.2.12, 5.3.1, or a currently supported vendor release.; Apply operating system or distribution PHP security updates where PHP is vendor-packaged.; Use max_file_uploads where supported to limit upload file counts..

Prepared

Jun 28, 2026, 15:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.