phpseclib CVE-2026-55599

Exploitation requires that the target application invokes phpseclib's X509::validateSignature() - or any code path that calls it - on a certificate supplied or influenced by the attacker, such as mutual TLS client certificates, certificate chains received from external peers, or user-submitted PEM/DER files processed for validation. The application must run an unpatched phpseclib version (1.x ≤ 1.0.29, 2.x ≤ 2.0.54, or 3.x ≤ 3.0.53) and must not have explicitly set disable_url_fetch to true (it defaults to false, so most deployments are exposed without any additional misconfiguration). No authentication to the vulnerable application is required - the CVSS PR:N confirms this. Exploitation is bounded to SSRF impact: the attacker can cause the server to open TCP connections to arbitrary hosts and ports and may retrieve responses if the application surfaces validation error details, but direct code execution is not indicated by available data. Blind SSRF scenarios (no response reflection) still allow internal port scanning and metadata endpoint probing.

The CVSS 3.1 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) accurately captures the scope-changed nature of the vulnerability - the SSRF allows pivoting to internal systems beyond the vulnerable server - but the medium severity score may understate real-world priority for cloud-hosted deployments. The Scope:Changed metric is key: successful exploitation can reach AWS/GCP/Azure metadata endpoints (169.254.169.254), potentially exposing IAM credentials, instance identity tokens, or internal API surfaces, turning a C:L rating into a high-impact secondary breach. Attack Complexity is Low and no privileges are required since any party who can submit a certificate for validation can trigger the flaw - no special knowledge or timing is needed. EPSS data was not provided in the input and exploitation probability cannot be quantified. No CISA KEV listing exists; active exploitation is not confirmed. The advisory contains precise source code references (file paths, line numbers, code snippets), making this straightforward to reproduce, and the insecure-default nature means no misconfiguration is required - the full install base of unpatched versions is exposed. The confidentiality impact is limited to SSRF probing rather than direct data exfiltration unless the application reflects fetched content, which constrains but does not eliminate real-world severity.

An attacker submits a crafted X.509 client certificate - containing a malicious AIA caIssuers URL pointing to the AWS EC2 metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) - to a PHP web application that calls phpseclib's X509::validateSignature() to authenticate the certificate. Without any authentication to the application, phpseclib silently fetches the attacker-specified URL from the server's network context, potentially returning IAM role credentials to the attacker if the application reflects validation diagnostics or errors containing the fetched content. No standalone public exploit tool was referenced in the advisory, but the exact source file paths and code snippets published in GHSA-m557-wrgg-6rp4 make reproducing the trigger trivial.