PHPUnit EUVD-2026-28649

Exploitation requires: (1) PHPUnit version exactly 12.5.21 or 13.1.5, (2) Attacker ability to modify content of INI values read by PHPUnit - specifically write access to phpunit.xml, phpunit.xml.dist, host php.ini files, or the PHP binary's environment variables, (3) PHPUnit execution with --process-isolation flag enabled or execution of PHPT tests (both spawn child processes that receive INI settings via command-line arguments), (4) For remote code execution via auto_prepend_file injection, the child process must have filesystem write access or the attacker must predict/control an existing file path that PHP will execute. The primary realistic condition is CI/CD pipelines configured to run PHPUnit tests against untrusted pull requests without code sandboxing (Poisoned Pipeline Execution). Standard local development usage where developers run PHPUnit on their own machines is low risk unless the developer's environment is already compromised. Deployments not using process isolation or PHPT tests are not affected even with vulnerable versions installed.

CVSS 7.8 (High) reflects local attack vector requiring low-privilege local access (AV:L/AC:L/PR:L), but real-world risk depends heavily on deployment context. The CVSS score alone suggests standard local privilege escalation, but the GitHub advisory emphasizes Poisoned Pipeline Execution (PPE) as the primary threat model: a contributor submits a pull request modifying phpunit.xml to include a malicious newline-encoded INI value, which executes when CI runs PHPUnit tests against the untrusted branch. Newlines are not visually distinctive in diff reviews, creating a realistic social engineering vector. EPSS data not provided, but exploitation requires specific conditions (PHPUnit with process isolation, attacker control of INI configuration sources). No CISA KEV listing indicates no confirmed widespread exploitation. The public GitHub Security Advisory (GHSA-qrr6-mg7r-m243) and merged pull request #6592 constitute public disclosure of exploit technique, though no standalone POC tool identified. Primary risk is to CI/CD pipelines executing PHPUnit tests on external contributions without sandboxing, not general local privilege escalation scenarios. Organizations not using PHPUnit in CI or already isolating untrusted code execution face minimal practical risk despite high CVSS.

A malicious contributor forks a PHP project using PHPUnit and submits a pull request modifying phpunit.xml to add <ini name="display_errors" value="1\nauto_prepend_file=/tmp/backdoor.php"/> where \n is a literal newline character. The project's CI system automatically runs PHPUnit tests against the PR branch. PHPUnit spawns a child process with arguments -d display_errors=1 -d auto_prepend_file=/tmp/backdoor.php, injecting the second directive. If the attacker previously wrote /tmp/backdoor.php via another vulnerability or predictable temp file creation, PHP loads and executes it before running tests, achieving code execution in the CI environment. The attacker can exfiltrate secrets, modify build artifacts, or persist access. Public pull request #6592 demonstrates the injection mechanism and can be adapted into working exploit code.