CVE-2026-6735 is a cross-site scripting vulnerability (CWE-79) in PHP Group's PHP software affecting versions 8.2.*, 8.3.*, 8.4.*, and 8.5.* before the respective patch versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6. The issue stems from improper neutralization of user input during web page generation on the PHP-FPM status page, enabling attackers to craft malicious URLs that execute arbitrary JavaScript code in the victim's browser. The CVSS 4.0 base score is 7.3, indicating high severity with network attack vector, low attack complexity, partial user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently provided, and the remediation level is not specified.

Successful exploitation allows execution of arbitrary JavaScript code in the context of the victim's browser when viewing the PHP-FPM status page. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires the victim to interact with a crafted URL. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the PHP-FPM status page to trusted administrators only and avoid clicking on untrusted URLs that reference this page. Monitor official PHP Group communications for updates on patches or mitigations.