CVE-2024-5585 is a high severity (CVSS 7.7) command injection in PHP's proc_open on Windows. It bypasses the earlier fix for CVE-2024-1874 when a command name ends in a space. PHP 8.1.29, 8.2.20 and 8.3.8 contain the fix. Linux and macOS hosts are not the target.
What's affected
The NVD record lists PHP 8.1 before 8.1.29, 8.2 before 8.2.20, and 8.3 before 8.3.8. The patched versions in the GitHub advisory match: 8.1.29, 8.2.20, 8.3.8.
There is a small difference between sources. The GitHub advisory's affected field names only 8.3.6, while the NVD record gives the full ranges below the patched releases. Plan to the NVD ranges, since they cover every release before the fixes.
Both sources rate it high at 7.7. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
The affected scenario is narrow. The advisory describes the use of proc_open with the array form of the command on Windows, where the arguments of the executed command come from an untrusted user. It states the fix for CVE-2024-1874 does not hold if the command name includes trailing spaces. Fedora also shipped updates, and the record links them.
How to check if you're exposed
Start by finding your PHP versions and which of them run on Windows:
php -v
php -r "echo PHP_OS_FAMILY, PHP_EOL;"
If the second line prints Windows and the first shows a version below 8.1.29, 8.2.20 or 8.3.8 in its line, the host needs the update.
Then check whether your code can reach the risky path. Search for proc_open in your own code and in vendored libraries:
grep -rn "proc_open" --include=*.php .
A hit that builds the command from user input is the case to fix first. A hit in a library you do not control is a reason to check that library's advisories. Reachability analysis helps here, because it can tell you whether code that calls the function is actually reached from your application.
What to do now
- Inventory PHP installs and mark the ones running on Windows.
- Upgrade to 8.1.29, 8.2.20 or 8.3.8, or any later release in your branch.
- Search your code and dependencies for proc_open calls that take any part of the command from outside.
- Where you cannot upgrade yet, stop passing user controlled values as command names or arguments to proc_open.
- Rerun your dependency scan so the PHP runtime version shows as fixed.
Why it matters
CWE-78, OS command injection, and CWE-116, improper encoding or escaping of output, both appear on the record. Escaping rules differ on Windows, where the shell parses a command line in its own way, so a correct fix for one input shape can miss a near neighbour.
That is the lesson of this CVE. It is a second bypass of the same bug class, the fix for CVE-2024-1874 not covering a trailing space. The record shows no KEV listing. The attack complexity is high in the score because the application has to pass untrusted values to proc_open in this form, which most do not.
Try it yourself
Runtime versions belong in your inventory next to libraries. See how an inventory surfaces them.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect PHP on Linux?
The advisory describes command arguments being injected in the Windows shell, and the record calls out Windows. Treat Linux hosts as outside the described issue, but upgrade anyway as part of normal patching.
Is CVE-2024-5585 a new bug or a bypass?
A bypass. The advisory says the fix for CVE-2024-1874 does not work when the command name includes trailing spaces.
Sources
Last reviewed: 19 October 2026.
