Which versions of PHP Censor are affected by CVE-2026-10273?

PHP Censor through version 2.1.6 is vulnerable to command injection via webhook endpoints, allowing attackers to execute arbitrary commands on your build infrastructure.. A patch is available.

Is there a public PoC exploit available for CVE-2026-10273?

Yes, a public proof-of-concept exploit is available for CVE-2026-10273. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2026-10273?

Within 24 hours: Identify all PHP Censor instances and assess whether webhook endpoints are accessible from untrusted networks. Within 7 days: Upgrade PHP Censor to patched version per vendor advisory. Within 30 days: Review build logs and artifacts processed during the exposure window for unauthorized or suspicious changes.

PHP Censor CVE-2026-10273

Q: What is the CVSS score of CVE-2026-10273?

CVE-2026-10273 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-33667 MEDIUM

OS Command Injection (CWE-78)

2026-06-01 VulDB

GHSA-93rv-mf2v-vv2r

PHP Command Injection N A Php Censor

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Source Code Evidence Fetched

Jun 01, 2026 - 17:17 vuln.today

Analysis Generated

Jun 01, 2026 - 17:17 vuln.today

DescriptionCVE.org

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named cd68d102601320bd319d590b75f7652e66f0685f. It is recommended to apply a patch to fix this issue.

AnalysisAI

OS command injection in PHP Censor through 2.1.6 allows remote attackers to execute arbitrary shell commands by submitting a crafted commitId value to the webhook endpoint handled by src/Model/Build/GitBuild.php. The unsanitized commitId (and branch name) is interpolated into shell command strings passed to git log and clone operations, and publicly available exploit code exists per VulDB. No CISA KEV listing or EPSS score is provided, so exploitation appears opportunistic rather than confirmed active in the wild.

Technical ContextAI

PHP Censor is an open-source self-hosted continuous integration server written in PHP that builds projects in response to VCS webhook events. The flaw is a classic CWE-78 (OS Command Injection) caused by passing attacker-controllable strings - specifically the commitId parameter and the branch name - directly into shell command templates built via sprintf-style formatting before invocation through the Builder::executeCommand helper in GitBuild.php and HgBuild.php. The upstream patch (commit cd68d102601320bd319d590b75f7652e66f0685f, PR #441) wraps each tainted value with PHP's escapeshellarg() and removes the surrounding double-quotes from the format string, neutralizing shell metacharacters such as backticks, $(), semicolons, and pipes that would otherwise break out of the intended git/hg argument context.

RemediationAI

Apply the upstream fix available in PR https://github.com/php-censor/php-censor/pull/441 (commit cd68d102601320bd319d590b75f7652e66f0685f), which adds escapeshellarg() wrapping around the commitId and branch values; upgrade to the next tagged release containing this commit once published, since the input data confirms a patch is available but does not identify a specific fixed version tag. As a compensating control until upgrade, restrict network access to the PHP Censor webhook endpoint via firewall or reverse-proxy allowlist limited to your VCS provider's published webhook IP ranges (GitHub, GitLab, Bitbucket), accepting the trade-off that webhooks from unlisted sources will be dropped. Additionally, run the php-censor worker process under an unprivileged, sandboxed user account and consider disabling the affected webhook trigger path if the CI server only services manually triggered builds.