CVE-2013-6501: The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP throug...

Security readout for executives and security teams

This issue affects PHP configurations where the SOAP WSDL cache uses /tmp by default. Because /tmp is shared and predictable, a local user may be able to place a crafted cache file that PHP SOAP code later uses. The available bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most plausible on systems running PHP through 5.6.7 with the SOAP extension and default soap.wsdl_cache_dir=/tmp, especially where untrusted local users share the host. Network-only exposure is not established by the provided sources. Prioritize systems where old PHP, SOAP, and shared local users overlap. This is not shown as internet-wormable or actively exploited in the bundle, but it can matter in shared hosting, legacy estates, and regulated environments still running unsupported PHP. Mitigation focus: Check vendor advisories for the PHP packages in use.; Upgrade PHP packages according to supported vendor guidance.; Set soap.wsdl_cache_dir to a private, application-owned directory..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.