{"action":"Upgrade php7.4 to 7.4.28-1+deb11u1 or later.","affected":[{"fixed":"7.4.28-1+deb11u1","introduced":"0"}],"component":"php7.4","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:11","exploited":false,"fixed_versions":["7.4.28-1+deb11u1"],"id":"tcs_01M5NFDR5J0CG0R0RNY67T9345","modified_at":"2026-08-27T23:03:58.785783863Z","published_at":"2021-11-29T07:15:06.397Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-21707","https://security-tracker.debian.org/tracker/CVE-2021-21707"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-21707","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-21707"}],"summary":"In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename conta"}