CVE-2025-49597: 
PHP vulnerability analysis and mitigation

CVE-2025-49597 is a gadget chain vulnerability in the handcraftedinthealps/goodby-csv PHP library (a fork of goodby/csv) that can be leveraged to achieve remote code execution (RCE) when combined with an insecure deserialization flaw elsewhere in an application. It affects all versions prior to 1.4.3 of the Composer package handcraftedinthealps/goodby-csv. The advisory was published on June 13, 2025, by maintainer alexander-schranz, with the fix released the same day. It carries a CVSS v3.1 base score of 3.9 (Low) (GitHub Advisory, GHSA).

The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and stems from the CallbackCollection class in src/Goodby/CSV/Export/Standard/Collection/CallbackCollection.php lacking a __wakeup() magic method, making it usable as a PHP deserialization gadget. An attacker who can supply untrusted data to PHP's unserialize() function — via a separate vulnerability in the host application — could chain through this class to manipulate object attributes and ultimately achieve RCE. The library itself does not deserialize untrusted data; exploitation requires a pre-existing insecure deserialization entry point in the consuming application (GitHub Advisory, Patch Commit).

On its own, this vulnerability presents no direct threat; it only becomes dangerous when chained with a separate insecure deserialization vulnerability in the host application. If such a chain is successfully exploited, the impact could include limited confidentiality, integrity, and availability compromise (all rated Low in the CVSS scoring), with the theoretical upper bound being remote code execution on the server hosting the application. The scope is limited to the affected component and does not inherently enable lateral movement (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 4.99% (90th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges, high attack complexity, and a separate deserialization vulnerability in the target application, making opportunistic exploitation unlikely.

The primary remediation is to upgrade handcraftedinthealps/goodby-csv to version 1.4.3 or later via Composer (composer update handcraftedinthealps/goodby-csv). As a manual workaround, add a __wakeup() method to src/Goodby/CSV/Export/Standard/Collection/CallbackCollection.php that throws a BadMethodCallException to prevent deserialization of the class (GitHub Advisory, Patch Commit). Additionally, applications should avoid deserializing untrusted data and implement allowlists for deserialization to reduce the attack surface for gadget chain exploitation.

The vulnerability was reported by security researcher mcdruid and patched promptly by maintainer alexander-schranz on the same day of disclosure (June 13, 2025). Community reaction has been minimal given the low severity and indirect exploitability of the issue (GitHub Advisory).