In a new note from SecurityFocus and PHP Magazine, another PHP vulnerability has been brought to light.

Reportedly PHP is vulnerable to an arbitrary location file upload vulnerability. This issue is due to a failure of the PHP application to properly sanitize user-supplied file name input.

An attacker may exploit this issue to upload files to an arbitrary location on a computer running the affected software. This may facilitate arbitrary server-side script code execution as well as other attacks.

It is reported that this issue only affects PHP versions 4.2.0 and subsequent.

This could definitely be bad news for sites out there allowing file uploads. As of the time of this posting, no other information has been made availible.