This vulnerability (CVE-2026-6735) in PHP affects multiple recent versions prior to specific patch levels. It is caused by improper neutralization of input during web page generation (CWE-79), specifically in the PHP-FPM status page. An attacker can create a malicious URL that, when visited by a user viewing the PHP-FPM status page, results in execution of arbitrary JavaScript code on the user's machine. The CVSS 4.0 score is 7.3 (high), reflecting network attack vector, low attack complexity, partial user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published but no official remediation level or patch links are currently available.

Successful exploitation allows execution of arbitrary JavaScript code in the context of the PHP-FPM status page viewed by a user, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires the victim to visit a crafted URL and does not require privileges or authentication. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the PHP-FPM status page to untrusted users or the public internet. Consider restricting access to the status page via network controls or authentication mechanisms to reduce risk.