CGA-hj27-vp72-6wxh

CVE-2022-4455 affects the third-party 'sproctor/php-calendar' web application (https://github.com/sproctor/php-calendar), specifically an XSS vulnerability in the index.php file involving manipulation of $_SERVER['PHP_SELF']. The php-8.5-calendar subpackage is PHP's built-in calendar extension, which is a compiled binary library (calendar.so) that provides calendar conversion functions. The subpackage contains no PHP source files, no index.php file, no web application code, and no XSS vulnerability vectors. These are completely different software components with different codebases and zero code overlap.