What is the CVSS score of EUVD-2025-16939?

EUVD-2025-16939 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-16939?

Atheos IDE versions before 6.0.4 contain a critical command injection vulnerability in Git functionality that allows authenticated administrators to execute arbitrary system commands on hosting…. A patch is available.

How to fix or mitigate EUVD-2025-16939?

Within 24 hours: Identify all Atheos IDE instances in your environment and document current versions. Within 7 days: Upgrade all Atheos instances to version 6.0.4 or later; restrict administrative access to Atheos to only essential personnel pending upgrade. Within 30 days: Conduct access audit of all Atheos administrative accounts; implement network segmentation isolating Atheos from sensitive systems; deploy monitoring on Git-related command execution within Atheos environments.

PHP EUVD-2025-16939

| CVE-2025-49008 CRITICAL

OS Command Injection (CWE-78)

2025-06-05 security-advisories@github.com

PHP RCE

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:55 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

604

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16939

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

CVE Published

Jun 05, 2025 - 01:15 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd() in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a Common::safe_execute function that sanitizes all arguments using escapeshellarg() prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

AnalysisAI

Critical command injection vulnerability in Atheos IDE versions prior to 6.0.4, stemming from improper use of escapeshellcmd() in the Git component that allows argument injection leading to arbitrary command execution. The vulnerability affects Atheos administrators and users on vulnerable versions who can be compromised through a network-based attack requiring high privileges (authenticated admin access). An authenticated attacker with administrative rights can execute arbitrary system commands, potentially leading to complete server compromise, data breaches, and lateral movement within the hosting infrastructure.

Technical ContextAI

The vulnerability exists in /components/codegit/traits/execute.php where the Atheos IDE improperly implements shell command execution using PHP's escapeshellcmd() function. The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) stems from inadequate input sanitization before passing user-controlled arguments to shell execution contexts. While escapeshellcmd() removes special characters that have special meaning to shell, it fails to properly quote/escape individual arguments, allowing attackers to inject additional command arguments. The fix introduced in version 6.0.4 replaces this with escapeshellarg(), which properly quotes each argument individually and escapes any quotes within the argument, preventing argument injection attacks. Atheos (CPE: software:atheos) is a self-hosted, browser-based IDE with Git integration capabilities, making the vulnerable Git component a critical attack surface for authenticated users.

RemediationAI

Upgrade Atheos to version 6.0.4 or later immediately; details: Version 6.0.4 introduces the Common::safe_execute function that uses escapeshellarg() for proper argument sanitization and migrates all vulnerable execution paths to this templated system. Workaround: Restrict administrative access in Atheos; details: Limit the number of accounts with administrator privileges; implement strict access controls and audit logging for admin accounts; use multi-factor authentication if available. Mitigation: Network segmentation and monitoring; details: Restrict network access to Atheos instances to trusted networks only; monitor and log all Git operations and administrative actions; implement intrusion detection for suspicious command patterns. Code-level fix: Manual remediation if immediate patching is not possible; details: Review /components/codegit/traits/execute.php and replace all escapeshellcmd() usage with escapeshellarg() for individual arguments, or implement the Common::safe_execute template function from version 6.0.4.