Security readout for executives and security teams
Plain-English summary
This issue affects old PHP versions where a user-controlled input stream can influence metadata returned by stream_get_meta_data. If an application trusts that metadata, such as the reported URI, an attacker may mislead application logic around uploaded or opened files.
Executive priority
Prioritize remediation where legacy PHP remains in production, especially around upload or import workflows. Broader urgency is lower without cited active exploitation, but unsupported PHP versions carry compounding operational risk.
Technical view
PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allowed attacker-controlled stream metadata values when input streams were controllable, including data: URI cases. Impact depends on application code trusting stream metadata for decisions.
Likely exposure
Exposure is most likely in legacy PHP applications handling uploads, imports, or user-supplied streams and calling stream_get_meta_data results in security, routing, storage, or trust decisions.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. Public details indicate attacker influence requires controllable input passed into affected stream handling, then application misuse of returned metadata.
Researcher notes
The available evidence is narrow: CVE description, PHP bug, PHP commit, and Ubuntu advisories. No CVSS, CWE, or exploitation telemetry is included. Validate impact through code paths, not version matching alone.
Mitigation direction
- Upgrade PHP beyond 5.5.32, 5.6.18, or 7.0.3 as applicable.
- Apply downstream vendor security packages, including relevant Ubuntu advisories where applicable.
- Stop trusting stream_get_meta_data output from attacker-controlled streams.
- Use trusted application state for file identity, path, and authorization decisions.
- Check current vendor guidance for unsupported or downstream PHP builds.
Validation and detection
- Inventory runtime PHP versions across web and worker hosts.
- Search code for stream_get_meta_data calls and use of returned uri values.
- Review upload and import paths that accept user-controlled files or stream URIs.
- Confirm patched PHP package versions through the operating system package manager.
- Test that file authorization does not depend on attacker-controlled stream metadata.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-10712 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- USN-3600-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- https://bugs.php.net/bug.php?id=71323CVE reference · x_refsource_CONFIRM
- https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=6297a117d77fa3a0df2e21ca926a92c231819cd5CVE reference · x_refsource_CONFIRM
- USN-3566-2CVE reference · vendor-advisory, x_refsource_UBUNTU
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.