CVE-2021-21707
Special characters break path parsing in XML functions
- Published
- Nov 29, 2021
- Updated
- Sep 17, 2024
- Assigning CNA
- php
- Evidence observed
- Aug 10, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NModerate · next 30 days
- Percentile
- 97.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Sources
1- php-8.1.0-dev-exploitExploit
Exploit for the PHP 8.1.0-dev backdoor vulnerability (CVE-2021-21707)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.