Wiki . Forums . Bugs . Translation . Privacy Policy | Search . Simple . Advanced | Reports . Help | Matrix . 10.x . 11.x . 12.x . 13.x . Future . Recent . Contribs

Bug 13521 - disable auto populate of argc and argv from web request's query string.
Summary: disable auto populate of argc and argv from web request's query string.
Status: CLOSED FIXED
Alias: None
Product: SME Server 11.X
Classification: SME Server
Component: e-smith-*/smeserver-* packages (show other bugs)
Version: 11.beta1
Hardware: --- ---
: P3 normal (vote)
Target Milestone: 11.0.rc1
Assignee: SME Server bug team
QA Contact: SME Server bug team
URL:
Depends on:
Blocks:
 
Reported: 2026-04-26 15:25 CEST by Jean-Philippe Pialasse
Modified: 2026-06-20 06:00 CEST (History)
1 user (show)

See Also:
Package: smeserver-php

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Philippe Pialasse 2026-04-26 15:25:57 CEST 
should set register_argc_argv = Off
in php.ini and /or php-fpm.d

could lead to  Remote Code Execution (RCE) vulnerabilities (e.g., CVE-2024-56145).

since php 85 having it enabled would show deprecated message


Deprecated: Deriving $_SERVER['argv'] from the query string is deprecated. Configure register_argc_argv=0 to turn this message off in Unknown on line 0
Comment 3 Jean-Philippe Pialasse 2026-06-20 06:00:55 CEST 
released
Comment 2 Brian Read 2026-06-06 12:28:23 CEST 
[root@sme11 ~]# cat /etc/php.ini | grep arg
register_argc_argv                     = Off
[root@sme11 ~]# cat /etc/php.d/

VERIFIED
Comment 1 Jean-Philippe Pialasse 2026-04-26 22:40:34 CEST 
Created task: 32897
Task info: http://koji.koozali.org/koji/taskinfo?taskID=32897
* Sun Apr 26 2026 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-25.sme
- SECURITY default register_argc_argv to off  [SME: 13521]