This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-17543 →

DEBIAN-CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from...

Original description

The description as published by the source.

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 php8.2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.33-1~deb12u1"}]}]

Debian:13 php8.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1~deb13u1"}]}]

Debian:14 php8.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1"}]}]

References

advisory security-tracker.debian.org