I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security?

If a user with subdomain FTP access on a cPanel server uploads a PHP script, can the privacy of other subdomains on the same domain be compromised, eg could the script obtain a file listing from another sub-domain or include files from the parent directory?

FTP access is restricted to the sub-domain directory.

  • Once you run a script on a server, then you open up a much wider range of threat vectors, but it depends on how the file and directory security is configured and what vulnerabilities exist. The short answer is "yes", but there are a lot of dependencies. Do you have a specific threat in mind?
    – schroeder
    Jan 4, 2019 at 12:57

2 Answers 2


Typically yes, but it depends on how the web server is configured.

If someone can run a PHP script on a server, he can execute commands, get file listings and include other files. However, this is still bound by normal user rights. On most systems all PHP files are executed as the "apache" or "httpd" user, which would need read access to all these files. This means that any PHP script can be read from any other PHP script.

However, it is possible to secure this. It is even possible to run two subdomains on two totally different webservers, which would make access between servers impossible.

  • To secure subdomains on the same server I assume I need to look at PHP execute permissions somewhere or Apache config?
    – Nick W
    Jan 5, 2019 at 13:09

Can a server not configured for multiple tennants present opportunities for badly behaving tennants to compromise the other sites? Yes, this is a concern and there are various ways to address the session issue.

The first is to set the open_base_dir (and session.save_path) to restrict each running PHP instance to a directory tree - similar to a chroot environment (note that this does not restrict other programs invoked by system() shell() etc). This is the most efficient (in terms of capacity/performance) but difficult to configure correctly.

Another solution is to make sure the umask is correctly configured, use php_fpm and run separate pools with separate uids for each site. But this does not make for effective use of the process pool.

Another solution is to encrypt the session data. If you use the suhosin encryption method, then you should use a separate key for each site - you need to be careful about where you put the keys and the permissions associated with that file. Alternatively you could encrypt the session with a key persisted in a client cookie and never committed to storage on the server. Encryption won't stop a bad tenant from corrupting other peoples data, but they won't be able to read it.

....and that's before you consider the possibilities of multiple php-fpm instances (or apache+mod_php) running in seperate chroot environments or seperate containers, or vms.....

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .