CVE-2014-5120: gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathna...

Security readout for executives and security teams

This issue affects older PHP 5.4 and 5.5 GD image handling. If an application passes attacker-influenced pathnames into certain image output functions, crafted input containing %00 could cause files to be overwritten. The practical risk depends on whether exposed application code lets users influence output file paths. Exposure is most likely in legacy PHP deployments running affected 5.4 or 5.5 versions with web applications that call GD output functions using user-controlled or insufficiently validated pathnames. Prioritize remediation where legacy PHP applications process images from users or write generated images to server paths. The bug is old, but arbitrary file overwrite can become business-impacting when combined with weak path handling or excessive write permissions. Mitigation focus: Upgrade PHP to 5.4.32, 5.5.16, or a later supported version.; Apply relevant vendor packages from Red Hat, openSUSE, Apple, Oracle, or your distribution.; Review image-processing code for user-controlled output paths..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.