CVE-2004-1063

CVE-2004-1063 describes a critical vulnerability affecting PHP versions 4.x up to 4.3.9 and 5.x up to 5.0.2 when operating in safe mode on multithreaded Unix webservers. This flaw allows local users to bypass safe_mode_exec_dir restrictions and execute arbitrary commands outside the designated directory by leveraging shell metacharacters in the current directory name. With a CVSS score of 10.0, this vulnerability is highly severe, indicating a network-based attack with low complexity and complete compromise of confidentiality, integrity, and availability. Despite its age and high severity, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion, with 10 mentions, suggesting ongoing interest and analysis.