CVE-2015-8866

critical

Published 2016-05-22 · Modified 2026-05-06

CVSS v3

9.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2

6.8

VIR risk

9.6

Description

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Predictions

Exploit likelihood

96%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://bugs.php.net/bug.php?id=64938

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://www.php.net/ChangeLog-5.php

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://www.openwall.com/lists/oss-security/2016/04/24/1

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2015-8866.html

OS impact

OS	Version	Status
sles		affected
ubuntu	12.04	affected
ubuntu	14.04	affected
ubuntu	15.10	affected
suse	42.1	affected
suse	13.2	affected

Application impact

Vendor	Product	Versions	Fixed
php	php	`{"startIncluding":"5.5.0","endExcluding":"5.5.22"}`	`5.5.22`

References

CWEs

CWE-611

Verify integrity in audit chain (admin only). AS-IS.