CVE-2015-2348: The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before...

Security readout for executives and security teams

CVE-2015-2348 is an old PHP file-upload flaw. A vulnerable PHP runtime could mishandle a destination path containing a NUL character, allowing an attacker to bypass intended file extension restrictions and create a file under an unexpected name. Exposure is most likely on legacy systems running affected PHP versions with public file-upload functionality, especially where application code builds the move_uploaded_file destination from user-influenced input or relies on extension checks. Treat as a legacy-platform risk. Prioritize remediation where affected PHP versions support public uploads or web-accessible storage. No active exploitation is evidenced in the provided sources, but exposed upload bugs can have high business impact. Mitigation focus: Upgrade PHP to 5.4.39, 5.5.23, 5.6.7, or later vendor-fixed packages.; Prefer a currently supported PHP branch where practical.; Review vendor advisories for platform-specific package status..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.