CVE-2026-22034
📋 TL;DR
This vulnerability in Snuffleupagus allows uploaded files in multipart POST requests to be executed as PHP code when specific non-default configurations are enabled. It affects deployments using upload validation with upstream VLD-based scripts while the VLD extension is unavailable to the CLI SAPI. Attackers could potentially execute arbitrary code on vulnerable systems.
💻 Affected Systems
- Snuffleupagus
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary PHP code execution allowing website defacement, data exfiltration, or backdoor installation.
If Mitigated
No impact if upload validation is disabled or properly configured with VLD available.
🎯 Exploit Status
Exploitation requires specific configuration but is straightforward once conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.0
Vendor Advisory: https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc
Restart Required: Yes
Instructions:
1. Update Snuffleupagus to version 0.13.0 or later. 2. Restart PHP-FPM or web server. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable upload validation
allTurn off the non-default upload validation feature in Snuffleupagus configuration
Edit snuffleupagus.rules file and remove or comment out upload validation directives
Ensure VLD extension availability
allMake sure the VLD extension is properly installed and available to CLI SAPI
php -m | grep vld
Check php.ini for CLI SAPI includes vld.so or vld.dll
🧯 If You Can't Patch
- Disable file upload functionality entirely on affected systems
- Implement strict file type validation and content inspection at application layer
🔍 How to Verify
Check if Vulnerable:
Check Snuffleupagus version and configuration: 1. Run 'php --ri snuffleupagus' to check version. 2. Review snuffleupagus.rules for upload validation settings. 3. Verify if VLD extension is loaded in CLI: 'php -m | grep vld'Check Version:
php --ri snuffleupagus | grep VersionVerify Fix Applied:
1. Confirm version is 0.13.0 or higher: 'php --ri snuffleupagus | grep Version'. 2. Test file upload functionality with non-PHP files to ensure they're not executed.📡 Detection & Monitoring
Log Indicators:
- Unexpected PHP execution from uploaded files
- File uploads with suspicious content patterns
- Errors related to VLD extension in PHP logs
Network Indicators:
- Multipart POST requests with file uploads to vulnerable endpoints
- Unexpected outbound connections from web server after file uploads
SIEM Query:
source="php_error.log" AND ("upload" AND "execution" OR "VLD") OR source="access.log" AND method="POST" AND uri CONTAINS "upload" AND status=200🔗 References
- https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100
- https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php
- https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py
- https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37
- https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc
- https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166
- https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274
- https://snuffleupagus.readthedocs.io/config.html#upload-validation
