CVE-2015-4026

CVE-2015-4026 is a path truncation vulnerability affecting PHP versions prior to 5.4.41, 5.5.25, and 5.6.9, specifically within the pcntl_exec implementation. This flaw, an incomplete fix for CVE-2006-7243, allows remote attackers to bypass extension restrictions and execute unintended files by injecting a null byte (\x00) into the pathname. With a CVSS score of 7.5, this vulnerability is considered high severity, indicating a network-based attack with low complexity that could lead to partial confidentiality, integrity, and availability compromise. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting low current threat activity.