What is the CVSS score of CVE-2026-25129?

CVE-2026-25129 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-25129?

Organizations using PsySH should be aware of notable risk from CVE-2026-25129, a DLL hijacking vulnerability rated CVSS 6.7. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25129?

Yes, a public proof-of-concept exploit is available for CVE-2026-25129. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25129?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-25129

MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-01-30 security-advisories@github.com

GHSA-4486-gxhx-5mg7

PHP Laravel Privilege Escalation Psysh

6.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 27, 2026 - 20:36 vuln.today

Public exploit code

CVE Published

Jan 30, 2026 - 21:15 nvd

MEDIUM 6.7

DescriptionGitHub Advisory

PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a .psysh.php file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation. This is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious .psysh.php, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation. Downstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (php artisan tinker) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the .psysh.php auto-load behavior can be abused in the same way to execute attacker-controlled code under the victim’s privileges. Versions 0.11.23 and 0.12.19 patch the issue.

AnalysisAI

PsySH versions prior to 0.11.23 and 0.12.19 automatically execute a .psysh.php file from the current working directory during startup, allowing local attackers with write access to a directory to achieve arbitrary code execution when a user launches PsySH from that location. When a privileged user such as root or a CI runner executes PsySH in an attacker-controlled directory, this results in local privilege escalation. Public exploit code exists for this vulnerability and no patch is currently available.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). Affects Psysh. PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a .psysh.php file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privileg