CVE-2024-9026

A flaw was found in PHP-FPM, the FastCGI Process Manager. This vulnerability can allow an attacker to manipulate or remove up to 4 characters from log messages via crafted log content, potentially polluting or altering the final log. If PHP-FPM is configured to use syslog output, further log data manipulation is possible via the same vector.

This vulnerability only affects configurations with the catch_workers_output directive enabled or set to yes in the configuration file. This option is disabled by default.

Additionally, if the error_log directive is set to syslog, the logs are being sent to syslogd instead of a regular file, allowing further log data manipulation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.