The flaw involves improper sanitation of user data within the PHP‑FPM status endpoint. When an attacker crafts a malicious URL, visiting the status page causes the target's browser to execute arbitrary JavaScript. This allows the attacker to run code in the context of any user who views the page, potentially stealing cookies, session identifiers or performing further actions impersonating that user.

The vulnerability affects PHP Group’s PHP implementation in versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21 and 8.5.x before 8.5.6. Systems running any of these releases that expose the PHP‑FPM status page to users are impacted.

The CVSS score of 7.3 classifies this as a high‑severity issue. EPSS data is not available, so the likelihood of exploitation cannot be quantified precisely. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack vector is inferred to be local or remote depending on whether the status page is publicly accessible; an attacker must be able to supply the crafted URL and have a victim view the page to benefit from the XSS.