CVE-2026-41570

Published: Mag 08, 2026 Last Modified: Mag 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets ' as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.

88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Read Application Data Modify Application Data
Applicable Platforms
Languages: Not Language-Specific, PHP
View CWE Details
93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Modify Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Phpunit by Phpunit Project

Product Information
Vendor Phpunit Project
Product Phpunit
Version 12.5.21
cpe:2.3:a:phpunit_project:phpunit:12.5.21:*:*:*:*:-:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Phpunit by Phpunit Project

Product Information
Vendor Phpunit Project
Product Phpunit
Version 13.1.5
cpe:2.3:a:phpunit_project:phpunit:13.1.5:*:*:*:*:-:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/sebastianbergmann/phpunit/pull/6592
https://github.com/sebastianbergmann/phpunit/pull/6592
https://github.com/sebastianbergmann/phpunit/pull/6592
https://github.com/sebastianbergmann/phpunit/pull/6592
https://github.com/sebastianbergmann/phpunit/security/advis…
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r…