CVE-2026-25129: 
PHP vulnerability analysis and mitigation

CVE-2026-25129 is a local privilege escalation vulnerability in PsySH, a runtime developer console and REPL for PHP, caused by automatic loading and execution of a .psysh.php configuration file from the Current Working Directory (CWD) on startup. Discovered and disclosed on January 30, 2026, it affects all PsySH versions prior to 0.11.23 and versions 0.12.0 through 0.12.18. Downstream consumers that embed PsySH — most notably Laravel Tinker (php artisan tinker) — also inherit this risk. The GitHub Advisory Database rates this as Moderate with a CVSS v3.1 score of 6.7, while Feedly's data reflects a score of 7.3 (High) (GitHub Advisory, PsySH Advisory).

The root cause is an Uncontrolled Search Path Element (CWE-427): PsySH unconditionally loads and executes any .psysh.php file found in the process's CWD at startup, without verifying file ownership, directory permissions, or requiring explicit user opt-in. This enables a CWD configuration poisoning attack — a low-privileged attacker writes a malicious .psysh.php to any world-writable or attacker-writable directory (e.g., /tmp), then waits for a higher-privileged user to launch PsySH or Laravel Tinker from that directory. The attack requires local access (AV:L), low privileges (PR:L), and user interaction in the form of the victim navigating to and launching PsySH from the poisoned directory (UI:R). A public proof-of-concept is included in the official advisory (PsySH Advisory).

Successful exploitation results in arbitrary code execution in the victim user's security context, with full confidentiality, integrity, and availability impact on the affected system. If the victim is a privileged user (e.g., root, a CI/CD runner, or an ops account), the attacker achieves local privilege escalation and can execute commands as that user. The risk extends to any application embedding PsySH, including Laravel Tinker, meaning the attack surface includes PHP web application development and deployment pipelines where privileged users routinely use these tools (GitHub Advisory, PsySH Advisory).

A proof-of-concept exploit is publicly available and included in the official security advisory, demonstrating code execution as root by planting a malicious .psysh.php in /tmp (PsySH Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.007–0.011%, indicating a low current probability of exploitation in the wild (GitHub Advisory). This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged shell on the target system (e.g., via a web shell, SSH, or another vulnerability).
2. Identify a writable directory: Locate a directory writable by the attacker that a privileged user is likely to use as their CWD — common targets include /tmp, shared project directories, or world-writable application folders.
3. Plant the malicious payload: Write a malicious .psysh.php file to the target directory. Example:

   echo "<?php file_put_contents('/tmp/poc.txt', shell_exec('id')); ?>" > /tmp/.psysh.php

4. Wait for victim interaction: Wait for a privileged user (e.g., root or a CI runner) to navigate to that directory and launch PsySH or a downstream tool like Laravel Tinker (php artisan tinker).
5. Trigger execution: When the victim runs PsySH from the poisoned CWD, the .psysh.php file is automatically loaded and executed in the victim's security context without any prompt or warning.
6. Verify privilege escalation: Confirm that the payload executed with the victim's privileges (e.g., check that /tmp/poc.txt is owned by root and contains uid=0(root)) (PsySH Advisory).

• File System: Presence of an unexpected .psysh.php file in world-writable or shared directories such as /tmp, /var/tmp, or project root directories; files created or modified by a privileged user (e.g., root) in directories owned by a lower-privileged user, indicating code execution under elevated context.
• Logs: System audit logs (e.g., auditd) showing a privileged process (root or CI runner) reading or executing .psysh.php from an untrusted directory; PHP process logs showing unexpected file I/O or command execution originating from a PsySH or artisan tinker invocation.
• Process: Unusual child processes spawned by psysh or php artisan tinker running as a privileged user (e.g., bash, curl, wget, nc) from a world-writable CWD; unexpected network connections initiated by PHP processes running with elevated privileges (PsySH Advisory).

Update PsySH to version 0.11.23 (for installations on the 0.11.x branch) or 0.12.19 (for installations on the 0.12.x branch), which introduce a "Restricted Mode" requiring explicit trust before loading local .psysh.php config files (v0.11.23 Release, v0.12.19 Release). Trust behavior in patched versions can be configured via the trustProject config option, --trust-project / --no-trust-project CLI flags, or the PSYSH_TRUST_PROJECT environment variable. As an interim workaround, ensure privileged users never launch PsySH or Laravel Tinker while their CWD is set to a world-writable or attacker-controlled directory, and restrict write permissions on directories where these tools are commonly invoked (GitHub Advisory).

The security blog Securing Laravel noted the vulnerability in a post advising users to update their packages, highlighting the downstream risk to Laravel Tinker users (Securing Laravel). The vulnerability was reported by researcher aqhmal and disclosed responsibly through GitHub's security advisory process. Red Hat also tracked the issue for their ecosystem (Red Hat CVE). Community reaction has been measured, consistent with the moderate severity rating and the requirement for local access and user interaction.