Which versions of PHP are affected by EUVD-2025-17626?

A critical OS command injection vulnerability exists in Zend.To versions up to 6.10-6 Beta that could allow remote attackers to execute arbitrary system commands on affected servers.

How to fix or mitigate EUVD-2025-17626?

Within 24 hours: Identify all systems running Zend.To and verify current version; implement network access controls to restrict access to affected systems. Within 7 days: Upgrade to version 6.10-7 or later (preferably 6.15-8 or current latest release); if upgrade is not immediately possible, implement WAF rules to block suspicious file_1 parameter inputs to NSSDropoff.php. Within 30 days: Complete full migration to the latest vendor release and validate all systems are patched; conduct security audit of affected systems for signs of compromise.

PHP EUVD-2025-17626

Q: What is the CVSS score of EUVD-2025-17626?

EUVD-2025-17626 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2025-5952 MEDIUM

Command Injection (CWE-77)

2025-06-10 cna@vuldb.com

PHP Command Injection

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17626

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 05:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file_1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.10-7 is able to address this issue. It is recommended to upgrade the affected component. This affects a rather old version of the software. The vendor recommends updating to the latest release. Additional countermeasures have been added in 6.15-8.

AnalysisAI

A critical OS command injection vulnerability exists in Zend.To versions up to 6.10-6 Beta, where unsanitized user input in the 'file_1' parameter of NSSDropoff.php's exec function allows remote, unauthenticated attackers to execute arbitrary system commands with application-level privileges. The vulnerability has been publicly disclosed with working exploits available, making active exploitation probable, though it affects an older software version that has been superseded by newer releases with additional security controls.

Technical ContextAI

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw occurring in the NSSDropoff.php file's exec function. Zend.To is a secure file transfer and drop-off solution typically deployed in enterprise environments. The root cause stems from insufficient input validation/sanitization on the 'file_1' parameter before it is passed to OS-level command execution functions (likely shell_exec, exec, or system in PHP). The affected product CPE would be approximately 'cpe:2.3:a:zend:zend.to:*:*:*:*:*:*:*:*' with versions 6.10-6 and earlier in the 6.x branch. The vulnerability is particularly dangerous because the exec function in PHP, when improperly used, directly invokes the operating system shell without proper escaping, allowing shell metacharacters and command separators to break out of intended command boundaries.

RemediationAI

action: Immediate Patch; details: Upgrade Zend.To to version 6.10-7 or later. Version 6.15-8 includes additional countermeasures and is recommended as the target release.; priority: Critical
action: Input Validation; details: If immediate patching is not feasible, implement strict input validation on the 'file_1' parameter. Whitelist only alphanumeric characters and safe file path characters; reject any special shell characters (|, ;, &, $, `, >, <, etc.).
action: Network Segmentation; details: Restrict network access to Zend.To instances to trusted internal IP ranges only. Do not expose NSSDropoff.php endpoints directly to the internet without authentication.
action: Web Application Firewall (WAF); details: Deploy WAF rules to detect and block payloads in the 'file_1' parameter containing shell metacharacters or command separators (e.g., 'file_1=*;whoami' patterns).
action: Monitoring; details: Enable application and system logging to detect suspicious command execution patterns in NSSDropoff.php access logs and OS process logs.