CVE-2011-0754: The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Window...

Security readout for executives and security teams

This is an old PHP-on-Windows issue where PHP could misidentify symbolic links. A local user might use that confusion to make software handle a linked file as if it were a normal file. The business risk is mainly legacy Windows PHP systems with local user access or shared hosting-style file permissions. Exposure appears limited to Windows systems running PHP before 5.3.4, especially where local users can create filesystem links and PHP code relies on SplFileInfo::getType for file-type decisions. Treat this as a legacy-risk cleanup item unless an exposed Windows PHP environment matches the conditions. Prioritize remediation for shared systems, regulated environments, or hosts where local users can influence files processed by PHP. Mitigation focus: Inventory Windows hosts running PHP versions earlier than 5.3.4.; Upgrade affected PHP installations to 5.3.4 or later per PHP guidance.; Restrict local users from creating links in paths processed by PHP applications..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.