Which versions of PHP are affected by CVE-2026-2952?

A HIGH severity vulnerability (CVE-2026-2952) has been identified in Vaelsys 4.1.0 affecting the HTTP POST request handler, with a public exploit available and no vendor patch currently available.

Is there a public PoC exploit available for CVE-2026-2952?

Yes, a public proof-of-concept exploit is available for CVE-2026-2952. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-2952?

Within 24 hours: Identify all systems running Vaelsys 4.1.0 and isolate them from critical network segments; enable enhanced logging on affected instances. Within 7 days: Deploy compensating controls including WAF rules to block malicious POST requests to /tree/tree_server.php and implement network segmentation to limit lateral movement. Within 30 days: Contact Vaelsys for patch status and timeline; evaluate alternative products or upgrade to a patched version once available; conduct forensic analysis to detect any prior exploitation.

PHP CVE-2026-2952

Q: What is the CVSS score of CVE-2026-2952?

CVE-2026-2952 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Command Injection (CWE-77)

2026-02-22 cna@vuldb.com

PHP Command Injection Vaelsys

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 25, 2026 - 18:16 vuln.today

Public exploit code

CVE Published

Feb 22, 2026 - 14:16 nvd

HIGH 7.3

DescriptionCVE.org

A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. This manipulation of the argument xajaxargs causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code execution in Vaelsys 4.1.0 allows unauthenticated attackers to execute arbitrary OS commands via malicious xajaxargs parameters sent to the /tree/tree_server.php endpoint. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. This network-accessible flaw poses immediate risk to exposed Vaelsys installations.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Vaelsys. A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. This manipulation of the argument xajaxargs causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.