CVE-2026-7260: Stack overflow in phar with circular symlinks

CVE-2026-7260 is a vulnerability in Stack overflow in phar with circular symlinks, rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.11% probability of exploitation activity in the next 30 days, higher than 2% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID: CVE-2026-7260
Severity: Medium CVSS 5.5
Microsoft severity: Moderate
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-121
EPSS: 0.11% (percentile 2%)
CISA KEV: Not listed
Released: 6 August 2026
Last updated: 6 August 2026
Patch Tuesday: July 2026 Patch Tuesday
Product families: Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-7260 at 5.5 (temporal 5.5) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Affected products (1)

Open Source Software

Product	Security update	Type	Fixed build	Restart
azl3 php 8.3.31-1 on Azure Linux 3.0	CBL-Mariner Releases	Security Update	8.3.33-1	No

NIST NVD data

NVD status: Analyzed
NVD CVSS: 5.5 (MEDIUM)
NVD weakness: CWE-121
Published to NVD: 30 July 2026
NVD last modified: 5 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
php	from 8.2.0, before 8.2.33
php	from 8.3.0, before 8.3.33
php	from 8.4.0, before 8.4.24
php	from 8.5.0, before 8.5.9

References

https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3 (Vendor Advisory)

Revision history

Version	Date	Description
1.0	6 August 2026	Information published.