CVE-2026-22034: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-22034 is a remote code execution (RCE) vulnerability in Snuffleupagus, a PHP security module designed to harden web applications. The flaw affects all versions prior to 0.13.0 and is triggered when the non-default upload validation feature is enabled and configured to use the upstream VLD-based validation scripts (upload_validation.php or upload_validation.py), but the VLD (Vulcan Logic Disassembler) PHP extension is not available to the CLI SAPI. Under these conditions, all files from multipart POST requests are evaluated as PHP code rather than safely inspected. The vulnerability was privately disclosed on December 30, 2025, and publicly disclosed on January 7–8, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory).

The root cause is classified as CWE-636 (Not Failing Securely / 'Failing Open'): when PHP cannot load the VLD extension, it emits a warning and continues execution rather than aborting, causing VLD-specific options like vld.execute=0 to have no effect. The upstream validation scripts invoke PHP via CLI with arguments intended to disassemble uploaded files using VLD (e.g., php -d vld.active=1 -d vld.execute=0 -d extension=vld.so ... <filename>); without VLD, this command reduces to simply executing the uploaded file as PHP code. Additionally, Snuffleupagus hooks php_rfc1867_callback() for the MULTIPART_EVENT_END event, which is triggered on any multipart POST request to any existing PHP script — not just file upload endpoints — broadening the attack surface. An attacker only needs to send a crafted multipart POST request containing a malicious PHP payload to any reachable PHP endpoint on the affected server (GitHub Advisory, Patch Commit).

Successful exploitation grants an unauthenticated remote attacker arbitrary PHP code execution on the server, running with the privileges of the web server process. This results in full compromise of confidentiality (access to all data accessible by the web server), integrity (ability to modify files, databases, and configurations), and availability (ability to crash or disrupt the service). The attacker could deploy web shells, exfiltrate sensitive data, pivot to internal network resources, or establish persistent access (GitHub Advisory).

A proof-of-concept reference is available via the GitHub Security Advisory, though no weaponized exploit kit or active in-the-wild exploitation has been confirmed as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.059%, reflecting a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the non-default upload validation feature to be enabled and VLD to be absent from the CLI SAPI — a misconfiguration that may exist in deployments that followed upstream documentation without ensuring VLD was properly installed.

1. Reconnaissance: Identify web servers running PHP with Snuffleupagus versions <= 0.12.0 that have the upload_validation feature enabled and configured to use scripts/upload_validation.php or scripts/upload_validation.py, but where the VLD PHP extension is not installed for the CLI SAPI.
2. Craft malicious payload: Prepare a file containing arbitrary PHP code (e.g., a web shell: <?php system($_GET['cmd']); ?>) to be submitted as a multipart POST file upload.
3. Identify a target endpoint: Locate any existing PHP script on the target server that accepts HTTP requests — the multipart POST callback is triggered on any PHP script, not just file upload handlers, due to Snuffleupagus hooking php_rfc1867_callback() for MULTIPART_EVENT_END.
4. Send multipart POST request: Submit the malicious file as part of a multipart POST request to the identified PHP endpoint (e.g., using curl -F 'file=@shell.php' https://target.example.com/any_script.php).
5. Trigger PHP execution: Snuffleupagus invokes the validation script, which calls PHP CLI on the uploaded temporary file; without VLD, the vld.execute=0 directive is ignored and the file is executed as PHP code on the server.
6. Achieve code execution: The attacker's PHP payload runs with web server process privileges, enabling command execution, data exfiltration, or further lateral movement (GitHub Advisory, Patch Commit).

• Network: Unusual multipart POST requests to PHP endpoints that do not normally handle file uploads; POST requests with Content-Type: multipart/form-data to arbitrary scripts from unexpected source IPs.
• Logs: Web server access logs showing multipart POST requests to non-upload PHP scripts; PHP error logs containing warnings such as Unable to load dynamic library 'vld.so' indicating VLD is missing from CLI SAPI.
• Process: Unexpected child processes spawned by the web server process (e.g., php CLI invocations with arguments like -d vld.active=1 -d extension=vld.so) executing temporary uploaded files from /tmp or the PHP upload temp directory.
• File System: Suspicious temporary files in the PHP upload temp directory (e.g., /tmp/php*) containing PHP code rather than legitimate file content; unexpected web shells or scripts appearing in web-accessible directories after POST requests.

Upgrade Snuffleupagus to version 0.13.0 or later, which fixes the issue by adding the -l (syntax-check-only) flag to the PHP CLI invocation in both upload_validation.php and upload_validation.py, preventing file execution even when VLD is absent (Patch Commit). If immediate patching is not possible, either disable the upload_validation feature in the Snuffleupagus configuration, or ensure the VLD extension is properly installed and available to the CLI SAPI before using VLD-based validation scripts. Administrators should also review server logs for evidence of exploitation attempts, particularly unexpected PHP CLI processes executing files from the upload temp directory (GitHub Advisory).

The vulnerability was reported by security researcher thomas-chauchefoin-tob (Trail of Bits) and privately disclosed to the Snuffleupagus maintainers on December 30, 2025, with a fix committed promptly before public disclosure on January 7, 2026 (GitHub Advisory). The Snuffleupagus project published a release blog post at dustri.org covering the 0.13.0 release. No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been observed.