# PHP-CGI argument injection on Windows (CVE-2024-4577) · pwn.watch

> A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.

Page: https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577 · generated 2026-10-23T03:01:01.167Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: PHP Group PHP
- Started: 2024-06-06 · closed: 2024-06-12
- CVEs: CVE-2024-4577
- Affected: PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode
- Fixed in: 8.3.8; 8.2.20; 8.1.29

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577/feed.xml
- JSON Feed: https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json
- This file: https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577/llms.txt

## Updates (newest first)
- 2024-06-12: CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- 2024-06-09: CVE-2024-4577 published (https://nvd.nist.gov/vuln/detail/CVE-2024-4577)
- 2024-06-06: DEVCORE discloses CVE-2024-4577; fixed PHP releases available (https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/)

## Fix brief
# Security brief: PHP-CGI argument injection on Windows (CVE-2024-4577)

Source: https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577 · status: closed (closed Jun 12, 2024) · severity: critical · updated Jun 12, 2024

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.

Severity detail: CVSS 9.8 (v3.1, CNA), actively exploited (CISA KEV); known ransomware use

- Product: PHP Group PHP
- CVE / advisory ids: CVE-2024-4577

## Affected versions
- PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
php -v
php -r 'echo PHP_VERSION, PHP_EOL;'
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 8.3.8
- 8.2.20
- 8.1.29

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Jun 12, 2024: CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03)
- Jun 9, 2024: CVE-2024-4577 published
- Jun 6, 2024: DEVCORE discloses CVE-2024-4577; fixed PHP releases available

## Advisories
- [GHSA-3qgc-jrrr-25jv: argument injection in PHP-CGI](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv) (PHP (GitHub))
- [PHP Group advisory: CVE-2024-4577](https://www.php.net/ChangeLog-8.php#) (PHP Group)
- [NVD: CVE-2024-4577](https://nvd.nist.gov/vuln/detail/CVE-2024-4577) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Security alert: CVE-2024-4577, PHP CGI argument injection vulnerability](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/)

## Caveats
Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).

---
Machine-readable: https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.