Multipart-file uploads call variables to be improperly registered in the global scope.

published 2018-12-31 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-18094

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).

Patch / fix

fixed in 1 links 2

Facebook HHVM 3.21.10

github.com/facebook/hhvm@6937de5 commit
hhvm.com/blog/2018/03/30/hhvm-3.25.2.html advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 18 mo ago (2025-05-06)

Exploit prediction

1.91% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Facebook HHVM

Classification

Weakness

CWE-621 Variable Extraction Error
CWE-20 Improper Input Validation

References

github.com /facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff
patch, third-party-advisory
hhvm.com /blog/2018/03/30/hhvm-3.25.2.html
patch, third-party-advisory

Sources

CVE List CVE-2018-6334
NVD CVE-2018-6334

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary