CVE-2020-7062

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

• CWE-476
• CWE-476

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlMailing List, Third Party Advisory
• https://bugs.php.net/bug.php?id=79221Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00034.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-57Third Party Advisory
• https://usn.ubuntu.com/4330-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4717Third Party Advisory
• https://www.debian.org/security/2020/dsa-4719Third Party Advisory
• https://www.tenable.com/security/tns-2021-14Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlMailing List, Third Party Advisory
• https://bugs.php.net/bug.php?id=79221Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00034.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-57Third Party Advisory
• https://usn.ubuntu.com/4330-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4717Third Party Advisory
• https://www.debian.org/security/2020/dsa-4719Third Party Advisory
• https://www.tenable.com/security/tns-2021-14Third Party Advisory

Published

Feb 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7055An issue was discovered in Elementor 2.7.4. Arbitrary file u…9.9
• CVE-2020-7057Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version…5.3
• CVE-2020-7058data_input.php in Cacti 1.2.8 allows remote code execution v…8.8
• CVE-2020-7059When using fgetss() function to read data with stripping tag…9.1
• CVE-2020-7060When using certain mbstring functions to convert multibyte e…9.1
• CVE-2020-7061In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, wh…9.1
• CVE-2020-7063In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7…5.3
• CVE-2020-7064In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.…5.4
• CVE-2020-7065In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, wh…8.8
• CVE-2020-7066In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7…4.3
• CVE-2020-7067In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7…7.5
• CVE-2020-7068In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7…3.6