In PHP versions 8

CVE-2026-6735 is an XSS bug in the PHP-FPM status endpoint, not in ordinary PHP page rendering. Upstream affected ranges are PHP 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6; the vulnerable behavior is that attacker-controlled request data can be reflected into the status page, where it executes if someone views the HTML status output in a browser.

The vendor's MEDIUM 6.1 is defensible in a lab, but a little generous in real enterprise conditions. The chain needs pm.status_path enabled, the status page reachable, a victim to open the HTML view, and some same-origin value to steal or abuse; that is a long way from pre-auth RCE, and most mature shops already keep this page internal-only or disabled.

Why this verdict

• Start from the vendor 6.1 baseline, then subtract for endpoint exposure: exploitation begins only if pm.status_path is enabled and reachable; plenty of fleets never expose that path beyond localhost or monitoring IPs.
• Subtract again for attacker workflow friction: the bug needs an operator to open the HTML status page in a browser. JSON, XML, text, and OpenMetrics consumers do not turn this into active script execution.
• Subtract for blast radius: this is XSS in a status/monitoring surface, so the payoff is limited to the victim browser's same-origin context rather than arbitrary server execution or tenant-wide takeover.
• Keep it above IGNORE because the chain is still real: if you expose /fpm-status on the same origin as sensitive apps, a crafted URI plus an admin browser session can become useful session abuse.
• No threat pressure amplifier: supplied intel says EPSS 0.00046 and not KEV-listed, with no validated active exploitation evidence.

Why not higher?

It is not higher because this is not a one-packet internet RCE, auth bypass, or wormable edge bug. The exploit path assumes an exposed diagnostics page, a human viewing the HTML page, and enough same-origin value to make the XSS worthwhile.

Why not lower?

It is not lower because many teams do expose FPM status for troubleshooting, and some do it on the same hostname as production apps. If that operational shortcut exists, this bug can absolutely turn into session theft or authenticated action abuse against the victim browser context.

1. Restrict the status page to localhost or monitoring IPs — Apply web-server ACLs or reverse-proxy allowlists in normal change control. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is the single best compensating control because it kills the browser-accessible prerequisite entirely.
2. Disable pm.status_path where it is not operationally required — Remove or comment the directive in unused pools, then reload PHP-FPM during the next routine maintenance cycle. This is the cleanest way to eliminate exposure without waiting on package rollout.
3. Serve status on a separate internal-only origin — If operations truly need the page, move it behind a distinct hostname or management vhost not sharing cookies with production applications. For LOW, do this as backlog hygiene rather than emergency response.
4. Add a restrictive CSP on the status endpoint — Set a web-server header such as Content-Security-Policy: default-src 'none'; style-src 'self' 'unsafe-inline' if your status view still needs HTML. CSP is not perfect, but it reduces post-injection payoff and should be deployed in the next normal config update.

Run this on the target Linux host that serves PHP-FPM, not from an auditor workstation. Invoke it as sudo bash ./check-cve-2026-6735.sh; it needs read access to PHP-FPM binaries and pool config directories, so root or equivalent read privileges are recommended. The script is upstream-version aware and treats distro-backported packages conservatively as UNKNOWN when versioning is ambiguous.

#!/usr/bin/env bash
# check-cve-2026-6735.sh
# Detect likely exposure to CVE-2026-6735 (PHP-FPM status endpoint XSS)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

say() { echo "$1"; }

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

find_php_fpm_bin() {
  local c
  for c in php-fpm php-fpm8.5 php-fpm8.4 php-fpm8.3 php-fpm8.2 php-fpm8.1 php-fpm8.0 php-fpm7.4; do
    if have_cmd "$c"; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

get_php_fpm_version() {
  local bin="$1"
  "$bin" -v 2>/dev/null | awk '/^PHP / {print $2; exit}'
}

branch_fixed_version() {
  case "$1" in
    8.2) echo "8.2.31" ;;
    8.3) echo "8.3.31" ;;
    8.4) echo "8.4.21" ;;
    8.5) echo "8.5.6" ;;
    *) echo "" ;;
  esac
}

status_path_enabled() {
  local found=1
  local dirs=(
    /etc/php-fpm.d
    /etc/php/*/fpm/pool.d
    /usr/local/etc/php-fpm.d
    /usr/local/etc/php-fpm.d/*.conf
    /opt/remi/php*/root/etc/php-fpm.d
  )

  # shellcheck disable=SC2086
  grep -R -n -E '^[[:space:]]*pm\.status_path[[:space:]]*=' ${dirs[@]} 2>/dev/null | grep -v '^[[:space:]]*#' >/dev/null 2>&1
  found=$?
  return $found
}

BIN="$(find_php_fpm_bin || true)"
if [ -z "${BIN:-}" ]; then
  say "UNKNOWN: php-fpm binary not found"
  exit 2
fi

VER="$(get_php_fpm_version "$BIN")"
if [ -z "${VER:-}" ]; then
  say "UNKNOWN: unable to determine PHP-FPM version from $BIN"
  exit 2
fi

BRANCH="$(echo "$VER" | awk -F. '{print $1"."$2}')"
FIXED="$(branch_fixed_version "$BRANCH")"

if [ -z "$FIXED" ]; then
  say "UNKNOWN: PHP-FPM version $VER is outside upstream affected branches or may rely on distro backports"
  exit 2
fi

if ! status_path_enabled; then
  if ver_lt "$VER" "$FIXED"; then
    say "UNKNOWN: vulnerable upstream version $VER detected, but no enabled pm.status_path found in common config locations"
    exit 2
  else
    say "PATCHED: version $VER is at or above fixed upstream level $FIXED and no enabled status path was found"
    exit 0
  fi
fi

if ver_lt "$VER" "$FIXED"; then
  say "VULNERABLE: php-fpm version $VER is below fixed version $FIXED and pm.status_path appears enabled"
  exit 1
fi

say "PATCHED: php-fpm version $VER is at or above fixed version $FIXED; pm.status_path may be enabled, but upstream fix is present"
exit 0

Sources

1. NVD CVE-2026-6735
2. PHP 8 ChangeLog
3. PHP manual: FPM status page
4. CISA Known Exploited Vulnerabilities Catalog
5. Ubuntu USN-8336-1: PHP vulnerabilities
6. Debian LTS DLA-4586-1: php7.4 security update
7. Tenable CVE plugin coverage
8. PHP.Watch 8.2.31 release notes