EUVD-2026-33667
GHSA-93rv-mf2v-vv2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed PHP Censor webhook
-
DeliveryCraft webhook payload with malicious commitId
-
ExploitSend unauthenticated POST to build endpoint
-
ExecutionGitBuild.php interpolates value into git shell command
-
PersistShell executes injected commands as build user
-
ImpactStage follow-on actions on CI host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the PHP Censor webhook endpoint over the network and submit a build-trigger request containing a malicious commitId (or branch) value that flows into GitBuild::postCloneSetup or the clone-by-HTTP/SSH paths. No authentication is required per CVSS PR:N, no user interaction is required, and no special non-default configuration is needed beyond having a Git-based project configured in PHP Censor - which is the product's primary use case. Exploitation is limited where the webhook endpoint is not reachable from untrusted networks (e.g., bound to an internal interface or fronted by an IP allowlist for trusted VCS providers) and where the php-censor worker runs under a hardened service account that restricts what commands are useful to an attacker. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, unauthenticated, low-complexity exploitation with no user interaction, but the impact triplet C:L/I:L/A:L yields a base score of 7.3 - reflecting that PHP Censor build workers typically run as a low-privileged service account rather than root, limiting blast radius on the build host itself. The temporal metrics E:P/RL:O/RC:C confirm a proof-of-concept exists, an official fix is available, and reporting is confirmed, which together justify prompt patching. No EPSS score and no CISA KEV entry were supplied, so prevalence of active exploitation cannot be quantified; however, the attacker-controllable webhook input vector combined with public exploit details on GitHub issue #442 makes opportunistic scanning plausible against internet-exposed CI servers. Note that AV:N assumes the webhook endpoint is network-reachable - installations that restrict webhook delivery to trusted VCS IP ranges materially reduce real-world risk. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed PHP Censor instance (e.g., via Shodan fingerprinting of the login page) and sends a forged webhook POST to the build endpoint with a commitId field containing a shell-metacharacter payload such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
OS command injection in PHP Censor through 2.1.6 allows remote attackers to execute arbitrary shell commands by submitting a crafted commitId value to the webhook endpoint handled by src/Model/Build/GitBuild.php. The unsanitized commitId (and branch name) is interpolated into shell command strings passed to git log and clone operations, and publicly available exploit code exists per VulDB. No CISA KEV listing or EPSS score is provided, so exploitation appears opportunistic rather than confirmed active in the wild.
RemediationAI
Apply the upstream fix available in PR https://github.com/php-censor/php-censor/pull/441 (commit cd68d102601320bd319d590b75f7652e66f0685f), which adds escapeshellarg() wrapping around the commitId and branch values; upgrade to the next tagged release containing this commit once published, since the input data confirms a patch is available but does not identify a specific fixed version tag. As a compensating control until upgrade, restrict network access to the PHP Censor webhook endpoint via firewall or reverse-proxy allowlist limited to your VCS provider's published webhook IP ranges (GitHub, GitLab, Bitbucket), accepting the trade-off that webhooks from unlisted sources will be dropped. Additionally, run the php-censor worker process under an unprivileged, sandboxed user account and consider disabling the affected webhook trigger path if the CI server only services manually triggered builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PHP Censor is an open-source self-hosted continuous integration server written in PHP that builds projects in response to VCS webhook events. The flaw is a classic CWE-78 (OS Command Injection) caused by passing attacker-controllable strings - specifically the commitId parameter and the branch name - directly into shell command templates built via sprintf-style formatting before invocation through the Builder::executeCommand helper in GitBuild.php and HgBuild.php. The upstream patch (commit cd68d102601320bd319d590b75f7652e66f0685f, PR #441) wraps each tainted value with PHP's escapeshellarg() and removes the surrounding double-quotes from the format string, neutralizing shell metacharacters such as backticks, $(), semicolons, and pipes that would otherwise break out of the intended git/hg argument context.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named cd68d102601320bd319d590b75f7652e66f0685f. It is recommended to apply a patch to fix this issue.
Executive ViewAI
PHP Censor through version 2.1.6 is vulnerable to command injection via webhook endpoints, allowing attackers to execute arbitrary commands on your build infrastructure. This directly threatens the integrity of your CI/CD pipeline and enables injection of malicious code into production deployments.
Apply vendor patch. Interim: Restrict webhook endpoint access via network controls to known CI/CD trigger sources; disable external webhooks until patched; implement audit logging on all git and shell command execution within build pipelines.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB