CVE-2026-17543 – SQL Injection – PHP 8.2.x / 8.3.x / 8.4.x / 8.5.x (pgsql Extension)

Summary

CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP’s ext-pgsql extension, affecting PHP versions 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. The flaw resides in the PHP language runtime itself — not in application-level code — meaning applications that rely on PHP’s built-in PostgreSQL escape functions as their primary SQL injection defense are silently exposed. With a CVSS 4.0 score of 8.1, this vulnerability is exploitable remotely without authentication, and the official advisory characterizes exploitation as trivial.

Technical details

• Root cause: The vulnerability exists in php_pgsql_convert(), the internal function underpinning pg_select(), pg_insert(), pg_update(), and pg_delete(). The function uses PQescapeStringConn() to sanitize user-supplied values and then wraps them in PostgreSQL escape string constants (E'...') via php_pgsql_add_quotes(). When PostgreSQL operates with standard_conforming_strings = on — the default since PostgreSQL 9.1 — PQescapeStringConn() does not escape backslash characters. An attacker can supply input such as zzz' OR 1=1 --, causing the backslash to escape the closing quote delimiter and break out of the string context entirely.
• Trigger conditions: Any PHP application that passes attacker-controlled input through the affected functions (pg_select(), pg_insert(), pg_update(), or pg_delete()) against a PostgreSQL backend running with standard_conforming_strings = on is vulnerable. Because this is the PostgreSQL default for all modern versions, the vast majority of deployments are affected.
• Attack vector: Network-accessible; no authentication or user interaction required. The CVSS 4.0 vector confirms the attack is automatable (AU:Y) with no timing prerequisites (AT:N).
• Impact: High confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). Successful exploitation enables an attacker to read, modify, or delete arbitrary data in the connected PostgreSQL database. The fix — changing parameter wrapping from E'...' escape string constants to standard non-escaping string constants — confirms the flaw is a structural defect in the runtime’s escaping approach.

Affected software

• PHP 8.2.x — all versions before 8.2.33
• PHP 8.3.x — all versions before 8.3.33
• PHP 8.4.x — all versions before 8.4.24
• PHP 8.5.x — all versions before 8.5.9

The vulnerability affects applications using the ext-pgsql extension functions pg_select(), pg_insert(), pg_update(), and pg_delete() with attacker-controlled input.

Severity

CVSS 4.0 Base Score: 8.1 (HIGH)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U

Mitigation and recommended actions

• Immediate — upgrade PHP to a patched release:
  • PHP 8.2.33 or later
  • PHP 8.3.33 or later
  • PHP 8.4.24 or later
  • PHP 8.5.9 or later
• The PHP Group released patches simultaneously across all active branches, underscoring the severity of this issue. All organizations running PHP with a PostgreSQL backend should treat this as an emergency patch.
• If immediate patching is not possible: Audit all code paths that use pg_select(), pg_insert(), pg_update(), or pg_delete() with externally supplied input, and migrate those queries to use parameterized queries (prepared statements) via pg_query_params() or PDO with bound parameters, which are not affected by this flaw.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-17543 at NIST
• PHP Security Advisory GHSA-7qpv-r5mr-78m4
• CVE-2026-17543 in CVEProject