CVE-2018-6334

State: Published
Severity: 9.8 Critical
Published: Dec 31, 2018
Updated: May 6, 2025
Reserved: Jan 26, 2018

Description

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-621 Variable Extraction Error (CWE-621)

Affected Products

Product	Versions
HHVMFacebook	3.25.2Affected 3.25.0Affected 3.24.6Affected 3.22.0Affected 3.21.10Affected before 3.21.10Affected

References

https://github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff
https://hhvm.com/blog/2018/03/30/hhvm-3.25.2.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.