{"id":5759,"date":"2026-10-26T18:56:58","date_gmt":"2026-10-26T09:56:58","guid":{"rendered":"https:\/\/matoken.org\/blog\/?p=5759"},"modified":"2026-10-26T18:57:00","modified_gmt":"2026-10-26T09:57:00","slug":"session-upload_progress-enabled0","status":"publish","type":"post","link":"https:\/\/matoken.org\/blog\/2026\/10\/26\/session-upload_progress-enabled0\/","title":{"rendered":"PHP\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u7de9\u548c\u7b56\u306esession.upload_progress.enabled=0\u3092\u8a2d\u5b9a"},"content":{"rendered":"
\n
\n
\n

php\u304b\u3089\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u7de9\u548c\u7b56\u306e\u304a\u3057\u3089\u305b\u304c\u51fa\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<\/div>\n

\n
\n
\n

23 Oct 2026
\nInformational advisory: Session upload progress<\/p>\n<\/div>\n

\n
\n
We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.<\/pre>\n<\/div>\n<\/div>\n<\/blockquote>\n
\n— PHP: News Archive – 2026<\/a>\n<\/div>\n<\/div>\n
<\/p>\n
\n
\u30d0\u30b0\u4fee\u6b63\u30ea\u30ea\u30fc\u30b9\u307e\u3067 session.upload_progress.enabled=0<\/code> \u3092\u8a2d\u5b9a\u3057\u3066\u304a\u304f\u3053\u3068\u304c\u304a\u52e7\u3081\u3055\u308c\u3066\u3044\u307e\u3059\uff0e
\n\u3053\u306e\u8a2d\u5b9a\u306f\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u30d7\u30ed\u30b0\u30ec\u30b9\u60c5\u5831\u306e\u8a2d\u5b9a\u306e\u3088\u3046\u3067\u3059\uff0e<\/p>\n<\/div>\n
\n
\u81ea\u74b0\u5883\u306f\u3069\u3046\u306a\u3063\u3066\u3044\u308b\u304b\u306a\u3068\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\uff0e<\/p>\n<\/div>\n
\n
phpinfo\u3092\u7528\u610f\u3057\u3066\u547c\u3073\u51fa\u3057\u3066\u78ba\u8a8d\u3057\u307e\u3059\uff0e<\/p>\n<\/div>\n
\n
phpinfo.php<\/div>\n
\n
<?php echo phpinfo(); ?><\/pre>\n<\/div>\n<\/div>\n
\n
On<\/code> \u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u6709\u52b9\u72b6\u614b\u306e\u3088\u3046\u3067\u3059\u3002<\/p>\n<\/div>\n
\n
\n
$ w3m -dump https:\/\/matoken.org\/phpinfo.php | grep session.upload_progress.enabled\nsession.upload_progress.enabled  On                          On<\/pre>\n<\/div>\n<\/div>\n
\n
\/etc\/php\/8.2\/apache2\/php.ini<\/code>, \/etc\/php\/8.2\/fpm\/php.ini`<\/code> \u3092\u7de8\u96c6\u3057\u307e\u3059\uff0e<\/p>\n<\/div>\n
\n
\n
@@ -1541,7 +1541,7 @@ session.sid_bits_per_character = 5\n ; Development Value: On\n ; Production Value: On\n ; https:\/\/php.net\/session.upload-progress.enabled\n-;session.upload_progress.enabled = On\n+session.upload_progress.enabled = 0\n\n ; Cleanup the progress information as soon as all POST data has been read\n ; (i.e. upload completed).<\/pre>\n<\/div>\n<\/div>\n
\n
\u30c7\u30fc\u30e2\u30f3\u3092\u518d\u8d77\u52d5\u3057\u3066\u304a\u304d\u307e\u3059\uff0e<\/p>\n<\/div>\n
\n
\n
$ sudo service apache2 restart\n$ sudo service php8.2-fpm restart<\/pre>\n<\/div>\n<\/div>\n
\n
\u518d\u5ea6\u8a2d\u5b9a\u3092\u78ba\u8a8d\u3059\u308b\u3068 Off<\/code> \u306b\u306a\u308a\u307e\u3057\u305f\uff0e<\/p>\n<\/div>\n
\n
\n
$w3m -dump https:\/\/matoken.org\/phpinfo.php | grep session.upload_progress.enabled\nsession.upload_progress.enabled  Off                         Off<\/pre>\n<\/div>\n<\/div>\n
\n
\u78ba\u8a8d\u304c\u7d42\u308f\u3063\u305f\u3089phpinfo\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u52d5\u304b\u306a\u304f\u3057\u3066\u304a\u3044\u305f\u307b\u3046\u304c\u3044\u3044\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002<\/p>\n<\/div>\n
\n
\n
$ sudo rm phpinfo.php<\/pre>\n<\/div>\n<\/div>\n
\n
\n
$ w3m -dump https:\/\/matoken.org\/phpinfo.php\nNot Found\n\nThe requested URL was not found on this server.\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nApache\/2.4.68 (Debian) Server at matoken.org Port 443<\/pre>\n<\/div>\n<\/div>\n
\n
\u3053\u306e\u72b6\u614b\u3067WordPress \u306e\u30e1\u30c7\u30a3\u30a2\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3001Nextcloud \u306e\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3092\u8a66\u3059\u3068\u30d7\u30ed\u30b0\u30ec\u30b9\u304c\u52d5\u304d\u307e\u3059\u3002
\n\u6050\u3089\u304fWeb\u30d6\u30e9\u30a6\u30b6\u5074\u3067\u306eJavaScript\u5b9f\u88c5\u306a\u306e\u304b\u306a\u3068\u601d\u3044\u307e\u3059(\u672a\u78ba\u8a8d)\u3002<\/p>\n<\/div>\n
\n
\u74b0\u5883<\/div>\n
\n
$ dpkg-query -W php apache2\napache2 2.4.68-1~deb12u1\nphp     2:8.2+93\n$ lsb_release -dr\nNo LSB modules are available.\nDescription:    Debian GNU\/Linux 12 (bookworm)\nRelease:        12\n$ arch\nx86_64<\/pre>\n<\/div>\n<\/div>\n
\n\n\n
\n
Note<\/div>\n<\/td>\n
\n\u3053\u306e\u74b0\u5883\u306fdist-upgrade \u3057\u3066\u304a\u3044\u305f\u307b\u3046\u304c\u3044\u3044\u3067\u3059\u306d\u3002\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
php\u304b\u3089\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u7de9\u548c\u7b56\u306e\u304a\u3057\u3089\u305b\u304c\u51fa\u3066\u3044\u307e\u3057\u305f\u3002 23 Oct 2026 Informational advisory: Session upload progress We suggest you set […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"webmentions_disabled_pings":false,"webmentions_disabled":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[739,7,6],"tags":[397,1301],"class_list":["post-5759","post","type-post","status-publish","format-standard","hentry","category-bookworm","category-debian-linux","category-linux","tag-php","tag-rce"],"_links":{"self":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/comments?post=5759"}],"version-history":[{"count":2,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5759\/revisions"}],"predecessor-version":[{"id":5761,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5759\/revisions\/5761"}],"wp:attachment":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/media?parent=5759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/categories?post=5759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/tags?post=5759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}