CVE-2026-25129
📋 TL;DR
This vulnerability allows arbitrary code execution when PsySH (a PHP developer console) automatically loads a malicious .psysh.php file from the current working directory. Attackers can escalate privileges if they can write to a directory where a victim later runs PsySH with elevated permissions. Affected users include developers, system administrators, and CI/CD pipelines using vulnerable PsySH versions.
💻 Affected Systems
- PsySH
- Laravel Tinker
- Any software embedding PsySH
📦 What is this software?
Psysh by Psysh
Psysh by Psysh
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via root privilege escalation when a privileged user runs PsySH in an attacker-controlled directory.
Likely Case
Local privilege escalation in development or CI environments where users run PsySH/Tinker with elevated permissions.
If Mitigated
Limited impact if users run PsySH only in trusted directories with proper permissions.
🎯 Exploit Status
Exploitation requires ability to write to target directory before victim runs PsySH there. Simple attack vector once directory access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PsySH 0.11.23 or 0.12.19
Vendor Advisory: https://github.com/bobthecow/psysh/security/advisories/GHSA-4486-gxhx-5mg7
Restart Required: No
Instructions:
1. Update PsySH via Composer: 'composer update psysh/psysh'. 2. For Laravel Tinker, update Laravel framework dependencies. 3. Verify version with 'composer show psysh/psysh'.
🔧 Temporary Workarounds
Restrict directory permissions
linuxEnsure PsySH is only run in directories with strict permissions preventing unauthorized writes.
chmod 700 /trusted/directory
chown root:root /trusted/directory
Disable auto-load via environment variable
allSet PSYSH_CONFIG environment variable to disable automatic loading of .psysh.php files.
export PSYSH_CONFIG=disable
🧯 If You Can't Patch
- Run PsySH only in trusted directories with restricted write permissions
- Implement strict access controls on directories where privileged users might run PsySH
🔍 How to Verify
Check if Vulnerable:
Check PsySH version with 'composer show psysh/psysh' or inspect vendor/psysh/psysh/src/PsySH.php version constant.Check Version:
composer show psysh/psysh | grep versionsVerify Fix Applied:
Confirm version is 0.11.23+ or 0.12.19+ and test that .psysh.php files no longer auto-execute from untrusted directories.📡 Detection & Monitoring
Log Indicators:
- Execution of unexpected PHP files from current directory
- PsySH/Tinker processes running from unusual directories
Network Indicators:
- None - local exploitation only
SIEM Query:
Process execution where command contains 'psysh' or 'artisan tinker' and current directory is world-writable