No. Generally, session data is only stored server-side and should not be readable by an attacker.
However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.
Reading Session Data from a File
Session data is stored in the file system of the server (the location is determined by
session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:
- you have a directory traversal vulnerability which allows the reading of files.
- on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
- you badly misconfigured your server, and
session.save_path is publicly accessible
Reading Session Data from $_SESSION
If an attacker can read variables, they can also read their $_SESSION global variable.
This will mainly happen when you have a code execution vulnerability, so you have other things to worry about then.
But one could imagine code that makes it possible to read out variables, a simple example may be