CVE-2015-3411

CVE-2015-3411 describes a vulnerability in PHP versions before 5.4.40, 5.5.24, and 5.6.8, where the software fails to properly sanitize pathnames, allowing the inclusion of null bytes (%00). This flaw enables remote attackers to bypass intended file access restrictions and potentially read or write to arbitrary files through crafted input to functions like DOMDocument load methods or finfo_file. The vulnerability has a CVSS score of 6.5 (Medium), indicating a low attack complexity and no user interaction required, with potential for partial confidentiality and integrity impact. Despite its potential, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.