Search: CVE-2026-93682

CVE-2026-93682 is an out-of-bounds read vulnerability in the PHP HTTP stream wrapper. When following a redirect, if the Location header is empty, the code reads one byte beyond the allocated buffer. This byte influences the redirect target, allowing a malicious server to control whether the client is redirected to the host root or the current directory. The vulnerability has a medium severity with a CVSS score of 5.8.