← Voltar para CVEs
CVE-2026-22034
CRITICAL9.8
Descricao
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
Detalhes CVE
Pontuacao CVSS v3.19.8
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado1/8/2026
Ultima modificacao3/9/2026
Fontenvd
Avistamentos honeypot0
Produtos afetados
jvoisin:snuffleupagus
Fraquezas (CWE)
CWE-636
Referencias
https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100(security-advisories@github.com)
https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php(security-advisories@github.com)
https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py(security-advisories@github.com)
https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37(security-advisories@github.com)
https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc(security-advisories@github.com)
https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166(security-advisories@github.com)
https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274(security-advisories@github.com)
https://snuffleupagus.readthedocs.io/config.html#upload-validation(security-advisories@github.com)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.