CVE-2026-33183: 
PHP vulnerability analysis and mitigation

CVE-2026-33183 is a path traversal vulnerability in the Saloon PHP HTTP client library (composer package saloonphp/saloon) affecting all versions prior to 4.0.0. The flaw exists in the fixture name handling mechanism, where fixture names were used to construct file paths without validation, allowing traversal sequences such as ../ or ../../etc/passwd to escape the intended fixture directory. It was disclosed on March 25, 2026, via a GitHub Security Advisory (GHSA-f7xc-5852-fj99) and published to the NVD on March 26, 2026. The CVSS v3.1 base score is 9.1 (Critical) per Feedly threat intelligence data, though the GitHub Advisory Database rates it as Moderate/Low with a CVSS v4 score of 6.3, reflecting differing assessments of attack requirements (GitHub Advisory, Saloon Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where fixture names supplied to Saloon's MockResponse fixture system were directly concatenated into file paths beneath the configured fixture directory without sanitization (GitHub Advisory). An attacker who can influence the fixture name — for example, through user-controlled request parameters or configuration values passed to the fixture layer — can inject path traversal sequences (e.g., ../, ../../etc/passwd, or null bytes) to cause file reads or writes outside the intended directory. The fix in v4.0.0 addresses this at two layers: the fixture layer rejects names containing /, \, .., or null bytes and enforces a safe character set, while the storage layer adds a defense-in-depth check ensuring the resolved path remains under the base directory before any I/O operation (Saloon Advisory).

Successful exploitation allows an attacker to read arbitrary files accessible to the application process (high confidentiality impact), potentially exposing credentials, configuration files, private keys, or source code, and to write or overwrite arbitrary files (high integrity impact), which could corrupt application data or enable further compromise such as writing malicious configuration or code files. Availability is not directly impacted by this vulnerability. The exploitability is conditional on fixture names being derived from attacker-controlled input, which limits the attack surface to applications that expose this pathway (GitHub Advisory, Saloon Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the application derives fixture names from user- or attacker-controlled input, which is a non-trivial precondition that reduces real-world risk.

1. Identify target application: Locate a PHP application using saloonphp/saloon versions prior to 4.0.0 that uses Saloon's fixture/mocking system (e.g., MockResponse with named fixtures) and exposes fixture name selection to user-controlled input such as request parameters or configuration.
2. Determine input vector: Identify the parameter or input field that influences the fixture name used by the application (e.g., a query parameter, API field, or config value that is passed as the fixture name).
3. Craft traversal payload: Construct a fixture name containing path traversal sequences, such as ../../etc/passwd (for file read) or ../../var/www/html/shell.php (for file write), targeting files accessible to the web server process.
4. Send malicious request: Submit the crafted input to the application endpoint that triggers fixture loading or recording. For a read operation, the application will attempt to load the fixture file from the traversed path, returning its contents. For a write/record operation, the application will write response data to the traversed path.
5. Retrieve or leverage result: If reading, extract the sensitive file contents from the application's response or behavior. If writing, use the written file (e.g., a PHP web shell) for further exploitation (GitHub Advisory, Saloon Advisory).

• Logs: Application or web server logs showing requests with parameters containing ../, ..\, %2e%2e%2f, %2e%2e/, or null bytes (%00) in fields that map to fixture names; PHP error logs referencing unexpected file paths outside the fixture directory.
• File System: Unexpected files created or modified outside the Saloon fixture directory (e.g., in /etc/, /var/www/, or application root); new or modified PHP files (e.g., web shells) in web-accessible directories with timestamps correlating to suspicious requests.
• Network: Repeated or anomalous requests to application endpoints that trigger fixture loading, particularly with encoded traversal sequences in parameters.

Upgrade saloonphp/saloon to version 4.0.0 or later, which introduces validation in the fixture layer (rejecting names with /, \, .., or null bytes) and a defense-in-depth check in the storage layer. The official upgrade guide is available at https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4. As an interim measure, ensure that fixture names are never derived from user- or attacker-controlled input; if they must be, apply strict allowlist validation before passing them to Saloon (GitHub Advisory, Saloon Advisory).

The vulnerability was credited to researcher @HuajiHD for discovery and solution recommendations, with @JonPurvis applying the fix and @Sammyjo20 (the maintainer) verifying the remediation (Saloon Advisory). The advisory received standard coverage from vulnerability aggregators and databases shortly after disclosure, with no notable broader media coverage or significant community controversy identified.