Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
PHP 7.2 modules may mishandle file paths
published 3 months ago
Summary
The PHP 7.2 packages listed (libapache2-mod-php7.2, libphp7.2-embed, php7.2, php7.2-bcmath, php7.2-bz2) contain a coding mistake that can cause incorrect handling of file path separators. This could lead to unexpected behavior when the software processes certain archive files. Updating to the latest security patch fixes the code so the problem no longer occurs.
What to do
- Update canonical libapache2-mod-php7.2 to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical libphp7.2-embed to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2 to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-bcmath to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-bz2 to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-cgi to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-cli to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-common to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-curl to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-dba to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-dev to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-enchant to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-fpm to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-gd to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-gmp to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-imap to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-interbase to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-intl to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-json to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-ldap to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-mbstring to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-mysql to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-odbc to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-opcache to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-pgsql to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-phpdbg to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-pspell to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-readline to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-recode to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-snmp to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-soap to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-sqlite3 to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-sybase to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-tidy to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-xml to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-xmlrpc to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-xsl to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
- Update canonical php7.2-zip to version 7.2.24-0ubuntu0.18.04.17+tuxcare.els17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | libapache2-mod-php7.2 |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | libphp7.2-embed |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2 |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-bcmath |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-bz2 |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-cgi |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-cli |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-common |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-curl |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-dba |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-dev |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-enchant |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-fpm |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-gd |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-gmp |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-imap |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-interbase |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-intl |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-json |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-ldap |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-mbstring |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-mysql |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-odbc |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-opcache |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-pgsql |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-phpdbg |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-pspell |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-readline |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-recode |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-snmp |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-soap |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-sqlite3 |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-sybase |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-tidy |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-xml |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-xmlrpc |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-xsl |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
| TuxCare:Ubuntu:18.04 | canonical | php7.2-zip |
< 7.2.24-0ubuntu0.18.04.17+tuxcare.els17 Fix: upgrade to 7.2.24-0ubuntu0.18.04.17+tuxcare.els17
|
Original advisory text
Fix CVE(s): CVE-2026-7260
* SECURITY UPDATE: restore path separator in phar_get_link_location() so the
CVE-2026-7260 cycle walk stays idempotent (GHSA-vc5h-9ppw-p5f3)
- debian/patches/CVE-2026-7260.patch: restore path separator in
phar_get_link_location() so the CVE-2026-7260 cycle walk stays idempotent
(GHSA-vc5h-9ppw-p5f3)
- CVE-2026-7260
CVE-2026-7260 cycle walk stays idempotent (GHSA-vc5h-9ppw-p5f3)
- debian/patches/CVE-2026-7260.patch: restore path separator in
phar_get_link_location() so the CVE-2026-7260 cycle walk stays idempotent
(GHSA-vc5h-9ppw-p5f3)
- CVE-2026-7260
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1785836427.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-7260 Vendor Advisory
Timeline
Published4 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1785836427 · OSV
Track software like this
Free during beta