Vulnerability-Lookup

CVE-2026-24765 (GCVE-0-2026-24765)

Vulnerability from cvelistv5 – Published: 2026-01-27 21:35 – Updated: 2026-02-06 12:09

Title

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Summary

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sebastianbergmann/phpunit/secu…	x_refsource_CONFIRM
	https://github.com/sebastianbergmann/phpunit/comm…	x_refsource_MISC
	https://github.com/sebastianbergmann/phpunit/rele…	x_refsource_MISC
	https://github.com/sebastianbergmann/phpunit/rele…	x_refsource_MISC
	https://github.com/sebastianbergmann/phpunit/rele…	x_refsource_MISC
	https://github.com/sebastianbergmann/phpunit/rele…	x_refsource_MISC
	https://github.com/sebastianbergmann/phpunit/rele…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sebastianbergmann	phpunit	Affected: < 8.5.52 Affected: >= 9.0.0, < 9.6.33 Affected: >= 10.0.0, < 10.5.62 Affected: >= 11.0.0, < 11.5.50 Affected: >= 12.0.0, < 12.5.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T21:13:53.775602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-28T21:14:01.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-06T12:09:45.308Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phpunit",
          "vendor": "sebastianbergmann",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.5.52"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.6.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c 10.5.62"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.5.50"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0, \u003c 12.5.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `[\u0027allowed_classes\u0027 =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions  in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T21:35:54.292Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52"
        },
        {
          "name": "https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33"
        }
      ],
      "source": {
        "advisory": "GHSA-vvj3-c3rp-c85p",
        "discovery": "UNKNOWN"
      },
      "title": "PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24765",
    "datePublished": "2026-01-27T21:35:54.292Z",
    "dateReserved": "2026-01-26T21:06:47.867Z",
    "dateUpdated": "2026-02-06T12:09:45.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24765\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-27T22:15:56.790\",\"lastModified\":\"2026-03-03T15:25:01.720\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `[\u0027allowed_classes\u0027 =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions  in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.\"},{\"lang\":\"es\",\"value\":\"PHPUnit es un framework de pruebas para PHP. Se ha descubierto una vulnerabilidad en versiones anteriores a 12.5.8, 11.5.50, 10.5.62, 9.6.33 y 8.5.52 que involucra la deserializaci\u00f3n insegura de datos de cobertura de c\u00f3digo en la ejecuci\u00f3n de pruebas PHPT. La vulnerabilidad existe en el m\u00e9todo `cleanupForCoverage()`, que deserializa archivos de cobertura de c\u00f3digo sin validaci\u00f3n, lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo si archivos `.coverage` maliciosos est\u00e1n presentes antes de la ejecuci\u00f3n de la prueba PHPT. La vulnerabilidad ocurre cuando un archivo `.coverage`, que no deber\u00eda existir antes de la ejecuci\u00f3n de la prueba, es deserializado sin la restricci\u00f3n del par\u00e1metro `allowed_classes`. Un atacante con acceso de escritura de archivos local puede colocar un objeto serializado malicioso con un m\u00e9todo `__wakeup()` en el sistema de archivos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario durante las ejecuciones de pruebas con la instrumentaci\u00f3n de cobertura de c\u00f3digo habilitada. Esta vulnerabilidad requiere acceso de escritura de archivos local a la ubicaci\u00f3n donde PHPUnit almacena o espera archivos de cobertura de c\u00f3digo para las pruebas PHPT. Esto puede ocurrir a trav\u00e9s de ataques a la cadena de CI/CD, el entorno de desarrollo local y/o dependencias comprometidas. En lugar de simplemente sanear silenciosamente la entrada a trav\u00e9s de `[\u0027allowed_classes\u0027 =\u0026gt; false]`, el mantenedor ha optado por hacer expl\u00edcito el estado an\u00f3malo tratando los archivos `.coverage` preexistentes para las pruebas PHPT como una condici\u00f3n de error. A partir de las versiones 12.5.8, 11.5.50, 10.5.62, 9.6.33, cuando se detecta un archivo `.coverage` para una prueba PHPT antes de la ejecuci\u00f3n, PHPUnit emitir\u00e1 un mensaje de error claro que identifique el estado an\u00f3malo. Las organizaciones pueden reducir el riesgo efectivo de esta vulnerabilidad a trav\u00e9s de una configuraci\u00f3n adecuada de CI/CD, incluyendo ejecutores ef\u00edmeros, aplicaci\u00f3n de revisi\u00f3n de c\u00f3digo, protecci\u00f3n de ramas, aislamiento de artefactos y control de acceso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*\",\"versionEndExcluding\":\"8.5.52\",\"matchCriteriaId\":\"5D9FEAE5-A87C-4075-B6DC-891777C96DD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.6.33\",\"matchCriteriaId\":\"640B3B46-B435-42D9-9CD4-8FF9F0AF3B9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.5.62\",\"matchCriteriaId\":\"4C8CECCD-A520-48D3-9813-596887E7B75A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.5.50\",\"matchCriteriaId\":\"8F2BC1CB-876F-443C-8B49-6B2900165493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.5.8\",\"matchCriteriaId\":\"B2941A20-1ADB-41E7-B171-C138FC2612BF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-02-06T12:09:45.308Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24765\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-28T21:13:53.775602Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-28T21:13:58.231Z\"}}], \"cna\": {\"title\": \"PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling\", \"source\": {\"advisory\": \"GHSA-vvj3-c3rp-c85p\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"sebastianbergmann\", \"product\": \"phpunit\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 8.5.52\"}, {\"status\": \"affected\", \"version\": \"\u003e= 9.0.0, \u003c 9.6.33\"}, {\"status\": \"affected\", \"version\": \"\u003e= 10.0.0, \u003c 10.5.62\"}, {\"status\": \"affected\", \"version\": \"\u003e= 11.0.0, \u003c 11.5.50\"}, {\"status\": \"affected\", \"version\": \"\u003e= 12.0.0, \u003c 12.5.8\"}]}], \"references\": [{\"url\": \"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p\", \"name\": \"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda\", \"name\": \"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63\", \"name\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50\", \"name\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8\", \"name\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52\", \"name\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33\", \"name\": \"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `[\u0027allowed_classes\u0027 =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions  in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-27T21:35:54.292Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24765\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-06T12:09:45.308Z\", \"dateReserved\": \"2026-01-26T21:06:47.867Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-27T21:35:54.292Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-VVJ3-C3RP-C85P

Vulnerability from github – Published: 2026-01-27 22:26 – Updated: 2026-02-06 15:30

Summary

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage() Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
Local Development Environment: An attacker with shell access or ability to write files to the project directory
Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
- A malicious actor placed it intentionally
- Build artifacts from a previous run contaminated the environment
- An unexpected filesystem state requiring investigation
Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
- Isolate CI/CD runners (ephemeral, containerized environments)
- Restrict code execution on protected branches
- Scan pull requests and artifacts for tampering
- Use branch protection rules to prevent unreviewed code execution

Severity Classification

Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
User Interaction (UI): None (N) — automatic execution during standard test execution
Scope (S): Unchanged (U) — impact remains within the affected test execution context
Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
Code Review Enforcement: Require human review and approval before executing code from pull requests
Branch Protection: Enforce branch protection rules that block unreviewed code execution
Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

Visibility: The error appears prominently in CI/CD output and test logs
Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

Pull requests from forks or untrusted sources execute in isolated environments
Branch protection rules require human review before code execution
CI/CD runners are ephemeral and discarded after each build
Build artifacts are not reused across independent runs without validation

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpunit/phpunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpunit/phpunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.6.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpunit/phpunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.5.62"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpunit/phpunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.5.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpunit/phpunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24765"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-27T22:26:22Z",
    "nvd_published_at": "2026-01-27T22:15:56Z",
    "severity": "HIGH"
  },
  "details": "### Overview\n\nA vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test.\n\n### Technical Details\n\n**Affected Component:** PHPT test runner, method `cleanupForCoverage()`\n**Affected Versions:** \u003c= 8.5.51, \u003c= 9.6.32, \u003c= 10.5.61, \u003c= 11.5.49, \u003c= 12.5.7\n\n### Vulnerable Code Pattern\n\n```php\nif ($buffer !== false) {\n    // Unsafe call without restrictions\n    $coverage = @unserialize($buffer);\n}\n```\n\nThe vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.\n\n### Attack Prerequisites and Constraints\n\nThis vulnerability requires **local file write access** to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:\n\n* **CI/CD Pipeline Attacks:** A malicious pull request that places a `.coverage` file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information\n* **Local Development Environment:** An attacker with shell access or ability to write files to the project directory\n* **Compromised Dependencies:** A supply chain attack inserting malicious files into a package or monorepo\n\n**Critical Context:** Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of [Poisoned Pipeline Execution (PPE) attacks](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution) affecting CI/CD systems.\n\n### Proposed Remediation Approach\n\nRather than just silently sanitizing the input via `[\u0027allowed_classes\u0027 =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition.\n\n#### Rationale for Error-Based Approach:\n\n1. **Visibility Over Silence:** When an invariant is violated (a `.coverage` file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input\n2. **Operational Security:** A `.coverage` file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:\n    * A malicious actor placed it intentionally\n    * Build artifacts from a previous run contaminated the environment\n    * An unexpected filesystem state requiring investigation\n3. **Defense-in-Depth Principle:** Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit\u0027s scope:\n    * Isolate CI/CD runners (ephemeral, containerized environments)\n    * Restrict code execution on protected branches\n    * Scan pull requests and artifacts for tampering\n    * Use branch protection rules to prevent unreviewed code execution\n\n### Severity Classification\n\n* **Attack Vector (AV):** Local (L) \u2014 requires write access to the file system where tests execute\n* **Attack Complexity (AC):** Low (L) \u2014 exploitation is straightforward once the malicious file is placed\n* **Privileges Required (PR):** Low (L) \u2014 PR submitter status or contributor role provides sufficient access\n* **User Interaction (UI):** None (N) \u2014 automatic execution during standard test execution\n* **Scope (S):** Unchanged (U) \u2014 impact remains within the affected test execution context\n* **Confidentiality Impact (C):** High (H) \u2014 full remote code execution enables complete system compromise\n* **Integrity Impact (I):** High (H) \u2014 arbitrary code execution allows malicious modifications\n* **Availability Impact (A):** High (H) \u2014 full code execution permits denial-of-service actions\n\n### Mitigating Factors (Environmental Context)\n\nOrganizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:\n\n* **Ephemeral Runners:** Use containerized, single-use CI/CD runners that discard filesystem state between runs\n* **Code Review Enforcement:** Require human review and approval before executing code from pull requests\n* **Branch Protection:** Enforce branch protection rules that block unreviewed code execution\n* **Artifact Isolation:** Separate build artifacts from source; never reuse artifacts across independent builds\n* **Access Control:** Limit file write permissions in CI environments to authenticated, trusted actors\n\n### Fixed Behaviour\n\nWhen a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:\n\n* **Visibility:** The error appears prominently in CI/CD output and test logs\n* **Investigation:** Operations teams can investigate the root cause (potential tampering, environment contamination)\n* **Fail-Fast Semantics:** Test execution stops rather than proceeding with an unexpected state\n\n### Recommendation\n\n**Update to the patched version immediately** if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project\u0027s CI/CD configuration to ensure:\n\n* Pull requests from forks or untrusted sources execute in isolated environments\n* Branch protection rules require human review before code execution\n* CI/CD runners are ephemeral and discarded after each build\n* Build artifacts are not reused across independent runs without validation",
  "id": "GHSA-vvj3-c3rp-c85p",
  "modified": "2026-02-06T15:30:59Z",
  "published": "2026-01-27T22:26:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24765"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sebastianbergmann/phpunit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling"
}

FKIE_CVE-2026-24765

Vulnerability from fkie_nvd - Published: 2026-01-27 22:15 - Updated: 2026-03-03 15:25

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda	Patch
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63	Release Notes
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50	Release Notes
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8	Release Notes
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52	Release Notes
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33	Release Notes
security-advisories@github.com	https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p	Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html	Mailing List, Third Party Advisory

Impacted products

Vendor	Product	Version
phpunit_project	phpunit	*
phpunit_project	phpunit	*
phpunit_project	phpunit	*
phpunit_project	phpunit	*
phpunit_project	phpunit	*
debian	debian_linux	11.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "5D9FEAE5-A87C-4075-B6DC-891777C96DD8",
              "versionEndExcluding": "8.5.52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "640B3B46-B435-42D9-9CD4-8FF9F0AF3B9A",
              "versionEndExcluding": "9.6.33",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "4C8CECCD-A520-48D3-9813-596887E7B75A",
              "versionEndExcluding": "10.5.62",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "8F2BC1CB-876F-443C-8B49-6B2900165493",
              "versionEndExcluding": "11.5.50",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "B2941A20-1ADB-41E7-B171-C138FC2612BF",
              "versionEndExcluding": "12.5.8",
              "versionStartIncluding": "12.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `[\u0027allowed_classes\u0027 =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions  in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control."
    },
    {
      "lang": "es",
      "value": "PHPUnit es un framework de pruebas para PHP. Se ha descubierto una vulnerabilidad en versiones anteriores a 12.5.8, 11.5.50, 10.5.62, 9.6.33 y 8.5.52 que involucra la deserializaci\u00f3n insegura de datos de cobertura de c\u00f3digo en la ejecuci\u00f3n de pruebas PHPT. La vulnerabilidad existe en el m\u00e9todo `cleanupForCoverage()`, que deserializa archivos de cobertura de c\u00f3digo sin validaci\u00f3n, lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo si archivos `.coverage` maliciosos est\u00e1n presentes antes de la ejecuci\u00f3n de la prueba PHPT. La vulnerabilidad ocurre cuando un archivo `.coverage`, que no deber\u00eda existir antes de la ejecuci\u00f3n de la prueba, es deserializado sin la restricci\u00f3n del par\u00e1metro `allowed_classes`. Un atacante con acceso de escritura de archivos local puede colocar un objeto serializado malicioso con un m\u00e9todo `__wakeup()` en el sistema de archivos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario durante las ejecuciones de pruebas con la instrumentaci\u00f3n de cobertura de c\u00f3digo habilitada. Esta vulnerabilidad requiere acceso de escritura de archivos local a la ubicaci\u00f3n donde PHPUnit almacena o espera archivos de cobertura de c\u00f3digo para las pruebas PHPT. Esto puede ocurrir a trav\u00e9s de ataques a la cadena de CI/CD, el entorno de desarrollo local y/o dependencias comprometidas. En lugar de simplemente sanear silenciosamente la entrada a trav\u00e9s de `[\u0027allowed_classes\u0027 =\u0026gt; false]`, el mantenedor ha optado por hacer expl\u00edcito el estado an\u00f3malo tratando los archivos `.coverage` preexistentes para las pruebas PHPT como una condici\u00f3n de error. A partir de las versiones 12.5.8, 11.5.50, 10.5.62, 9.6.33, cuando se detecta un archivo `.coverage` para una prueba PHPT antes de la ejecuci\u00f3n, PHPUnit emitir\u00e1 un mensaje de error claro que identifique el estado an\u00f3malo. Las organizaciones pueden reducir el riesgo efectivo de esta vulnerabilidad a trav\u00e9s de una configuraci\u00f3n adecuada de CI/CD, incluyendo ejecutores ef\u00edmeros, aplicaci\u00f3n de revisi\u00f3n de c\u00f3digo, protecci\u00f3n de ramas, aislamiento de artefactos y control de acceso."
    }
  ],
  "id": "CVE-2026-24765",
  "lastModified": "2026-03-03T15:25:01.720",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-27T22:15:56.790",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-24765 (GCVE-0-2026-24765)

GHSA-VVJ3-C3RP-C85P

Overview

Technical Details

Vulnerable Code Pattern

Attack Prerequisites and Constraints

Proposed Remediation Approach

Rationale for Error-Based Approach:

Severity Classification

Mitigating Factors (Environmental Context)

Fixed Behaviour

Recommendation

FKIE_CVE-2026-24765

Tags

Sightings

Nomenclature