Detections
Analytics

Echo: php-7.2: security update to 7.2.34+e1

medium Tenable Self-Hosted Container Security Plugin ID 477433

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing
 functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains
 URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus
 interpreting the filename differently from what the user intended, which may lead it to reading a
 different file than intended. (CVE-2021-21707)

Solution

Update the php-7.2 library and its related packages to version 7.2.34+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2021-21707

Plugin Details

Severity: Medium

ID: 477433

Version: Revision 1.1

Type: Local

Published: 10/25/2026

Updated: 10/25/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 50.89

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-21707

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/25/2026

Vulnerability Publication Date: 11/15/2021

Reference Information

CVE: CVE-2021-21707