CVE-2022-31631

CRITICAL 9.1CVE-2022-31631 · Published 12/02/2025 · updated 17/06/2026

In short

CVE-2022-31631 is a CRITICAL (CVSS 9.1) vulnerability affecting php (php).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.4% of all vulnerabilities.
Fix: update to 8.0.27, 8.1.15, 8.2.2 or later.

Package	Affected versions	Patched versions
php php	`≥ 8.0.0, < 8.0.27≥ 8.1.0, < 8.1.15≥ 8.2.0, < 8.2.2`	`8.0.278.1.158.2.2`

Description

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

References

bugs.php.net/bug.php · Vendor Advisory
security.netapp.com/advisory/ntap-20230223-0007 · Third Party Advisory

More vulnerabilities in php

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

php

≥ 8.0.0, < 8.0.27≥ 8.1.0, < 8.1.15≥ 8.2.0, < 8.2.2

8.0.278.1.158.2.2

More vulnerabilities in php

See all →