It was added in PHP 5.4.0. When a multipart upload contains a field named PHP_SESSION_UPLOAD_PROGRESS before the file part, PHP creates an entry in the session data and updates it as the file arrives, so another request can read how far the upload has got. The feature is on by default.
The catch is where it runs. The handler works while PHP is still parsing the request, on any endpoint that accepts a POST, before application code starts, and it writes upload details, including the file name, into the session. Few applications use it, because most progress bars are built with JavaScript instead.
In October 2026, PHP confirmed session upload progress as one of the paths for CVE-2026-109619. PHP advises turning it off, and suggests keeping it off after patching if you do not need it. Abstract Security reported on 22 October that in its lab a fully patched 8.2.35 host could still be taken over when the application also had a file inclusion flaw, because the handler writes the upload file name into the session file. That is one vendor's lab result, and the point is simply that the feature hands attackers a way to place data in a session. A separate flaw, CVE-2026-115560, was published on 23 October with no fix at the time, and PHP also advised turning upload progress off for it.
Check whether any of your code reads upload progress from $_SESSION. If it does not, turn the feature off at php.ini or pool level. If it does, plan a switch to a JavaScript-based progress bar, and purge old session files after you apply WAF rules.