CVE-2011-0752: The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite...

Security readout for executives and security teams

This is a legacy PHP issue where an application could unintentionally let input overwrite sensitive internal variables. In vulnerable contexts, that may weaken application access checks. The public record does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in legacy environments still running PHP before 5.2.15, especially applications that call extract() on externally influenced arrays. Modern supported PHP deployments should not be affected by this specific runtime version issue. Treat this as a legacy technology risk. It is urgent only where unsupported PHP before 5.2.15 remains in production, particularly on internet-facing applications with custom access-control logic. Mitigation focus: Upgrade PHP runtimes older than 5.2.15 to a supported vendor-maintained release.; Review vendor guidance and PHP release notes for the applicable fixed version.; Audit application code for extract() use with externally influenced data..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.