Snuffleupagus
CVE-2026-22034
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend multipart POST request with PHP payload
-
ExploitUpload validation uses unavailable VLD extension
-
ExecutionPHP code evaluated without proper validation
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Fail-secure design
|
| Exploitation Conditions | Snuffleupagus version prior to 0.13.0 with non-default upload validation feature enabled, configured to use VLD-based upstream validation scripts, while VLD extension unavailable to CLI SAPI. |
| Impact | CVSS 9.8 (Critical). No auth, network vector, low complexity. PoC available. Ironic vulnerability in a security hardening tool. Only affects non-default configurations using VLD-based validation without VLD installed. EPSS 0.05%. Patch available. |
| Exploit ScenarioDerived | An attacker targets a PHP application protected by Snuffleupagus with VLD-based upload validation. Since VLD is not installed, all uploads pass validation. The attacker uploads a PHP web shell that would normally be blocked. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Snuffleupagus PHP security module before 0.13.0 can be bypassed when upload validation uses VLD-based scripts without the VLD extension installed. This disables the upload security check entirely, allowing malicious PHP file uploads. PoC available, patch available.
Earlier versions of this analysis (1)
Snuffleupagus upload validation fails open when the VLD extension is unavailable, allowing malicious PHP uploads to bypass security checks.
RemediationAI
Update to Snuffleupagus 0.13.0. Verify that all required extensions for validation scripts are installed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
When upload validation is configured to use Vulcan Logic Disassembler (VLD) scripts but VLD is not installed, the validation silently fails open (CWE-636), approving all uploads regardless of content. This is a fail-open vulnerability in a security tool.
Know when Snuffleupagus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
Executive ViewAI
Organizations using Snuffleupagus face critical risk from CVE-2026-22034 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB