CVE-2019-10220

What it actually does

Relative path injection in directory entry lists allows traversal outside intended directories via crafted CIFS responses.

Why it matters to the business

Attackers could read or write files beyond expected boundaries on affected systems, risking data exposure or tampering; the issue affects an old PHP source component with no active exploitation signals and stable low EPSS.

How an attack unfolds

An attacker interacts with a vulnerable CIFS client implementation to return directory entries containing relative path sequences that the kernel fails to sanitize, resulting in unauthorized file system access.

How to fix it

Update php/php-src to commit d42be4a5cf0ecd8e0d57a772dae53ef4a8c6e785 or later; rebuild and deploy the patched version across all instances.

How to confirm the fix worked

Confirm the running source revision contains d42be4a5cf0ecd8e0d57a772dae53ef4a8c6e785; test directory listings from untrusted CIFS servers to verify no traversal occurs.

Typical attack path

1. Locate systems running vulnerable Linux kernel CIFS code or the affected PHP source revision
2. Position a malicious CIFS server or MITM the connection
3. Return directory listing responses embedding relative path traversals
4. Trigger client-side processing to access files outside the mount point

How to detect it

Review CIFS client logs and file system audit trails for unexpected accesses using .. or similar sequences; correlate with connections to external SMB servers.

What your security team should do

• Apply the fixed commit to all php/php-src builds immediately
• Audit CIFS client configurations for exposure to untrusted servers
• Monitor for path traversal indicators in file access logs