PHP: Session Upload Progress Injection (CVE-2026-115560)
Public proof-of-concept exploit code has been published for CVE-2026-115560, identified as a PHP Session Upload Progress Injection vulnerability.
CVE search metadata
CVE search record: CVE-2026-115560. KEV: no. Product: PHP. Brief: PHP: Session Upload Progress Injection (CVE-2026-115560). Brief link: https://feed.craftedsignal.io/briefs/2026-10-php-session-injection/
Triage facts
Revision 2- Applicability
- PHP
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 2Oct 26, 16:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
new product
Changed: affected_products, affected_vendors, lastmod, references, updates
Sources: 1
Public proof-of-concept exploit code for CVE-2026-115560 has been released on Sploitus. The vulnerability is described as a PHP Session Upload Progress Injection.