CVE-2026-41570

{
  "id": "CVE-2026-41570",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T15:16:40.420",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6."
    },
    {
      "lang": "es",
      "value": "PHPUnit es un framework de pruebas para PHP. En las versiones 12.5.21 y 13.1.5, PHPUnit reenvía la configuración INI de PHP a procesos hijo (utilizados para la ejecución de pruebas aisladas/PHPT) como argumentos de línea de comandos -d nombre=valor sin neutralizar los metacaracteres INI. Debido a que el analizador INI de PHP interpreta ’ como un delimitador de cadena, ; como el inicio de un comentario, y lo más importante, un salto de línea como un separador de directivas, un valor que contiene un salto de línea es analizado por el proceso hijo como múltiples directivas INI. Un atacante capaz de influir en un único valor INI puede, por lo tanto, inyectar directivas adicionales arbitrarias en la configuración del hijo, incluyendo auto_prepend_file, extensión, disable_functions, open_basedir, y otras. Establecer auto_prepend_file a una ruta controlada por el atacante produce ejecución remota de código en el proceso hijo. Este problema ha sido parcheado en las versiones 12.5.22 y 13.1.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sebastianbergmann",
          "product": "phpunit",
          "versions": [
            {
              "version": "= 12.5.21",
              "status": "affected"
            },
            {
              "version": "= 13.1.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T16:01:31.346640Z",
          "id": "CVE-2026-41570",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        },
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:12.5.21:*:*:*:*:-:*:*",
              "matchCriteriaId": "14399E6E-3DD0-4CD6-8D89-8C5A99034AE6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:13.1.5:*:*:*:*:-:*:*",
              "matchCriteriaId": "7948E33A-A79E-405B-AE5A-3CB710478DB9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sebastianbergmann/phpunit/pull/6592",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/sebastianbergmann/phpunit/pull/6592",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}