However, it fails to account for a newline character. This will appear to be two separate commands, both of which will be executed. This code, distributed with later versions of util.c, checks for the newline character on line 1. In general, we recommend against using the approach of filtering out bad characters. Instead, we recommend permitting only those characters that you are certain you can handle correctly.
Any remote user can run programs on the attacked machine as the uid running the Web sserver.
Solution Update to the latest version of phf, or disable it if unused. If you have feedback, comments, or additional information about this vulnerability, please send us email.