CWE-616
AllowedIncomplete Identification of Uploaded File Variables (PHP)
Abstraction: Variant · Status: Incomplete
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
11 vulnerabilities reference this CWE, most recent first.
GHSA-PR84-483F-RMG2
Vulnerability from github – Published: 2026-08-04 15:32 – Updated: 2026-08-04 15:32Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
{
"affected": [],
"aliases": [
"CVE-2026-67198"
],
"database_specific": {
"cwe_ids": [
"CWE-616"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T15:16:40Z",
"severity": "HIGH"
},
"details": "Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.",
"id": "GHSA-pr84-483f-rmg2",
"modified": "2026-08-04T15:32:23Z",
"published": "2026-08-04T15:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67198"
},
{
"type": "WEB",
"url": "https://christbowel.com/blog/perspective-5-0-0-five-cves"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/perspective-dos-via-virtualserver-protocol-dispatcher"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Use PHP 4 or later.
Mitigation
If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
Mitigation
For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.
No CAPEC attack patterns related to this CWE.