CVE-2026-22034

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22034", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T22:30:38.719Z", "datePublished": "2026-01-08T14:49:05.020Z", "dateUpdated": "2026-01-08T15:06:42.132Z"}, "containers": {"cna": {"title": "Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package", "problemTypes": [{"descriptions": [{"cweId": "CWE-636", "lang": "en", "description": "CWE-636: Not Failing Securely ('Failing Open')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc"}, {"name": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37", "tags": ["x_refsource_MISC"], "url": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37"}, {"name": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100", "tags": ["x_refsource_MISC"], "url": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100"}, {"name": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php", "tags": ["x_refsource_MISC"], "url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php"}, {"name": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py", "tags": ["x_refsource_MISC"], "url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py"}, {"name": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166", "tags": ["x_refsource_MISC"], "url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166"}, {"name": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274", "tags": ["x_refsource_MISC"], "url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274"}, {"name": "https://snuffleupagus.readthedocs.io/config.html#upload-validation", "tags": ["x_refsource_MISC"], "url": "https://snuffleupagus.readthedocs.io/config.html#upload-validation"}], "affected": [{"vendor": "jvoisin", "product": "snuffleupagus", "versions": [{"version": "< 0.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T14:49:05.020Z"}, "descriptions": [{"lang": "en", "value": "Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0."}], "source": {"advisory": "GHSA-c4ch-xw5p-2mvc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:06:01.257688Z", "id": "CVE-2026-22034", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:06:42.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22034", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-08T15:06:01.257688Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:06:08.840Z"}}], "cna": {"title": "Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package", "source": {"advisory": "GHSA-c4ch-xw5p-2mvc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jvoisin", "product": "snuffleupagus", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "references": [{"url": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc", "name": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37", "name": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100", "name": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php", "name": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py", "name": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166", "name": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274", "name": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274", "tags": ["x_refsource_MISC"]}, {"url": "https://snuffleupagus.readthedocs.io/config.html#upload-validation", "name": "https://snuffleupagus.readthedocs.io/config.html#upload-validation", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-636", "description": "CWE-636: Not Failing Securely ('Failing Open')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T14:49:05.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22034", "state": "PUBLISHED", "dateUpdated": "2026-01-08T15:06:42.132Z", "dateReserved": "2026-01-05T22:30:38.719Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T14:49:05.020Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "snuffleupagus", "vendor": "jvoisin", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jvoisin:snuffleupagus:*:*:*:*:*:*:*:*", "matchCriteriaId": "27E48E9D-66B6-409E-8510-A8770570D1A4", "versionEndExcluding": "0.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0."}, {"lang": "es", "value": "Snuffleupagus es un m\u00f3dulo que eleva el coste de los ataques contra sitios web eliminando clases de errores y proporcionando un sistema de parcheo virtual. En despliegues de Snuffleupagus anteriores a la versi\u00f3n 0.13.0 con la caracter\u00edstica de validaci\u00f3n de subida no predeterminada habilitada y configurada para usar uno de los scripts de validaci\u00f3n ascendentes basados en Vulcan Logic Disassembler (VLD) mientras la extensi\u00f3n VLD no est\u00e1 disponible para la SAPI CLI, todos los archivos de las solicitudes POST multipart se eval\u00faan como c\u00f3digo PHP. El problema se solucion\u00f3 en la versi\u00f3n 0.13.0."}], "id": "CVE-2026-22034", "lastModified": "2026-06-17T10:19:23.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22034", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:06:01.257688Z", "version": "2.0.3"}}]}, "published": "2026-01-08T15:15:45.150", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://snuffleupagus.readthedocs.io/config.html#upload-validation"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-636"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:40:47.674208+00:00", "value": {"mitigation_remediation": ["Upgrade Snuffleupagus to version 0.13.0 or newer. ", "If an immediate upgrade is not possible, disable the non\u2011default upload validation feature or switch to a validation script that does not rely on the VLD extension. ", "If the VLD extension must be used, ensure it is available to the CLI SAPI before enabling upload validation."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is Snuffleupagus from jvoisin. Versions prior to 0.13.0 with upload validation enabled and configured to use VLD\u2011based scripts while the VLD extension is not available to the CLI SAPI are vulnerable. The vulnerability does not affect later releases of Snuffleupagus.", "description_and_impact": "Snuffleupagus allows attackers to execute any PHP code that is uploaded through multipart POST requests when the non\u2011default upload validation feature is enabled and configured to use a Vulcan Logic Disassembler script, but the VLD extension is missing from the CLI SAPI. The flaw arises from a flaw in input validation (CWE\u2011636), causing every uploaded file to be evaluated as PHP code. This means an adversary can inject malicious PHP that the web application will execute, compromising confidentiality, integrity, and availability of the affected system.", "risk_and_exploitability": "The CVSS score of 9.2 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers would typically use a HTTP POST request with a multipart/form\u2011data payload to upload a file containing PHP code; if the module interprets the file as code, it will run with the PHP process\u2019s privileges. The issue has been fixed in version 0.13.0, so only legacy installations remain at risk."}}}}, "created": "2026-04-18T07:45:24.982085+00:00", "updated": "2026-04-18T07:45:24.982096+00:00", "vendors": []}