CVE-2025-1736

High

Advisory

Published 14 Mar 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.3; base score, highest
EPSS: 0.005; 43rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 12; of 17,781 indexed, latest versions
Container images: 11; deployed by those charts
Fix available: 6 of 6; affected packages

Stream HTTP wrapper header check might omit basic auth header

Carried by container images the latest versions of 12 of 17,781 indexed charts deploy, on 11 images.

Affected package	Affected versions	Fixed in	Images
php7.4deb	7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13, 7.4.3-4ubuntu2.15+2 more	7.4.3-4ubuntu2.29	6
php8.1deb	8.1.2-1ubuntu2.3, 8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.21	2
libphpbitnami	7.4.33-1	8.1.32	1
phpbitnami	7.4.33-2	8.1.32	1
php8.2deb	8.2.7-1~deb12u1	8.2.28-1~deb12u1	1
php8.3deb	8.3.6-0ubuntu0.24.04.3	8.3.6-0ubuntu0.24.04.4	1

OSV records: BIT-libphp-2025-1736 BIT-php-2025-1736 DEBIAN-CVE-2025-1736 UBUNTU-CVE-2025-1736
Also known as: BIT-php-min-2025-1736, GHSA-hgf5-96fm-v528, USN-7400-1

Charts affected

12 by stars

Chart

Latest

Affected images

Radar Score

zabbixcetic

3.1.3

1 of 5 See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	php8.1@8.1.2-1ubuntu2.3	8.1.2-1ubuntu2.21

Open the chart page →

33,725

snipeitt3n

3.4.1

1 of 2 See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
snipe/snipe-it :v6.0.14	55fb7636a98c	php7.4@7.4.3-4ubuntu2.13	7.4.3-4ubuntu2.29

Open the chart page →

18,509

zabbix-serveraekondratiev

1.0.6

1 of 4 See more

zabbix-server aekondratiev 1.0.6

1 of the 4 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-5.4.6	01de79c31391	php7.4@7.4.3-4ubuntu2.6	7.4.3-4ubuntu2.29

Open the chart page →

30,668

zabbix-server-mysqlfermosit

3.0.2

1 of 4 See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	php8.3@8.3.6-0ubuntu0.24.04.3	8.3.6-0ubuntu0.24.04.4

Open the chart page →

12,840

equizequiz

0.0.1

1 of 3 See more

equiz equiz 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.32 8.1.32

Open the chart page →

7,541

equizequiz-chart

0.0.1

1 of 3 See more

equiz equiz-chart 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.32 8.1.32

Open the chart page →

7,541

supportpalevilgn0me

0.1.6

1 of 1 See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	php7.4@7.4.29-1+ubuntu20.04.1+deb.sury.org+1	no fix listed

Open the chart page →

20,933

nominatimheywood8-helm-charts

3.10.8

1 of 3 See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
mediagis/nominatim :4.2	d0eae7b51374	php8.1@8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.21

Open the chart page →

14,290

kc-chartkc-chart

1.0.0

1 of 3 See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
jhoncytech/bookworm-apache-wordpress :latest	18c3ca1f411e	php8.2@8.2.7-1~deb12u1	8.2.28-1~deb12u1

Open the chart page →

8,860

phppgadminkfirfer

0.1.12

1 of 1 See more

phppgadmin kfirfer 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
kfirfer/phppgadmin :7.13.0-2	2efb4a5d74a3	php7.4@7.4.3-4ubuntu2.15	7.4.3-4ubuntu2.29

Open the chart page →

10,248

nominatimnominatim-chart

1.3.0

1 of 3 See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
mediagis/nominatim :3.7	c15e941485ef	php7.4@7.4.3-4ubuntu2.12	7.4.3-4ubuntu2.29

Open the chart page →

22,658

owncloudth-charts

0.2.1

1 of 1 See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-1736.

Container image	Digest	Package	Fixed in
owncloud/server :10.15.0	51d9b74fc2a8	php7.4@7.4.3-4ubuntu2.23	7.4.3-4ubuntu2.29

Open the chart page →

10,006

Container images carrying it

11 by charts deploying them

A fixed version is listed for 6 of the 6 affected packages.

Container image	Digest	Package	Fixed in	Used by
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.32 8.1.32	2
jhoncytech/bookworm-apache-wordpress :latest	18c3ca1f411e	php8.2@8.2.7-1~deb12u1	8.2.28-1~deb12u1	1
kfirfer/phppgadmin :7.13.0-2	2efb4a5d74a3	php7.4@7.4.3-4ubuntu2.15	7.4.3-4ubuntu2.29	1
mediagis/nominatim :3.7	c15e941485ef	php7.4@7.4.3-4ubuntu2.12	7.4.3-4ubuntu2.29	1
mediagis/nominatim :4.2	d0eae7b51374	php8.1@8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.21	1
owncloud/server :10.15.0	51d9b74fc2a8	php7.4@7.4.3-4ubuntu2.23	7.4.3-4ubuntu2.29	1
snipe/snipe-it :v6.0.14	55fb7636a98c	php7.4@7.4.3-4ubuntu2.13	7.4.3-4ubuntu2.29	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	php8.3@8.3.6-0ubuntu0.24.04.3	8.3.6-0ubuntu0.24.04.4	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-5.4.6	01de79c31391	php7.4@7.4.3-4ubuntu2.6	7.4.3-4ubuntu2.29	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	php8.1@8.1.2-1ubuntu2.3	8.1.2-1ubuntu2.21	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	php7.4@7.4.29-1+ubuntu20.04.1+deb.sury.org+1	no fix listed	1