CVE-2015-2301: Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and...

Security readout for executives and security teams

This is an old PHP memory-safety flaw in Phar archive renaming. On vulnerable PHP versions, a crafted path that causes a Phar archive rename to collide with an existing file can crash the process and may have other unspecified impact. The sources do not show active exploitation. Exposure is most likely on legacy systems still running affected PHP versions, especially public applications where untrusted input can influence Phar archive operations. Current supported PHP versions should not be affected by the vulnerable version range stated in the CVE description. Treat this as a legacy platform risk. It is not KEV-listed, but affected PHP versions are obsolete and should be removed or upgraded because public-facing crashable services create operational risk. Mitigation focus: Upgrade PHP beyond 5.5.22 or 5.6.6, preferably to a supported release.; Apply relevant vendor advisories for Debian, Ubuntu, SUSE, Red Hat, Apple, Oracle, HP, or Mandriva.; Remove or isolate legacy PHP runtimes that cannot be upgraded promptly..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.