CVE-2015-2348

CVE-2015-2348 is a path truncation vulnerability in the move_uploaded_file function of PHP versions prior to 5.4.39, 5.5.23, and 5.6.7, affecting products like Apple, OpenSUSE, PHP, and Red Hat. This flaw allows remote attackers to bypass file extension restrictions by injecting a null byte (\x00) into the filename, leading to the creation of files with unintended names. With a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N), it is a medium severity vulnerability, indicating low attack complexity and potential for unauthorized modification of files. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.