Improper escaping of backslashes in attacker-provided parameters allows trivial SQL injection when PHP uses ext-pgsql with E'...' string literals. The flaw can enable an adversary to inject unauthorized SQL commands, compromising data confidentiality, integrity, and possibly enabling further escalation. The weakness is classified as CWE-89.

The vulnerability affects PHP versions 8.2.* before 8.2.33, 8.3.* before 8.3.33, 8.4.* before 8.4.24, and 8.5.* before 8.5.9. All PHP releases from the PHP Group that match these version ranges are impacted.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. It is likely exploitable remotely when application code accepts user input passed to ext-pgsql without proper escaping or validation. While the exact attacker route depends on the application context, any environment that processes user-supplied data through E'...' literals is at risk.