CVE-2026-119193 with a CVSS score of 5.4 is a local privilege escalation vulnerability affecting PHPUnit versions 13.4.0 through 13.4.3. The flaw, classified as CWE-379, occurs in the PHPT code coverage handling mechanism, which writes temporary test files to a fixed directory within the system's shared temporary path. When this path is accessible by multiple users, such as on Linux systems with a shared /tmp directory, a local attacker with a valid account can exploit this by creating the directory before the developer runs tests. The attacker can then replace the temporary job file with malicious code before execution. Because the directory lacks the sticky bit and is created with permissions that allow modification by the owner, the attacker can rename the original file and insert their own payload. This allows the attacker to execute arbitrary code with the privileges of the developer running the tests. The attack is stealthy because the test still passes and the code coverage report remains complete, providing no visible indication of compromise. The primary business impact is the potential theft of sensitive data, including source code, credentials, and SSH keys, accessible to the compromised user. The vulnerability requires specific conditions, including a shared temporary directory and a code coverage driver, but poses a significant risk in multi-user environments where local access is granted to untrusted parties.
We recommend you to update PHPUnit to version 13.4.4.[/subscribe_to_unlock_form]
CVE-2026-119193 with a CVSS score of 5.4 is a local privilege escalation vulnerability affecting PHPUnit versions 13.4.0 through 13.4.3. The flaw, classified as CWE-379, occurs in the PHPT code coverage handling mechanism, which writes temporary test files to a fixed directory within the system's shared temporary path. When this path is accessible by multiple users, such as on Linux systems with a shared /tmp directory, a local attacker with a valid account can exploit this by creating the directory before the developer runs tests. The attacker can then replace the temporary job file with malicious code before execution. Because the directory lacks the sticky bit and is created with permissions that allow modification by the owner, the attacker can rename the original file and insert their own payload. This allows the attacker to execute arbitrary code with the privileges of the developer running the tests. The attack is stealthy because the test still passes and the code coverage report remains complete, providing no visible indication of compromise. The primary business impact is the potential theft of sensitive data, including source code, credentials, and SSH keys, accessible to the compromised user. The vulnerability requires specific conditions, including a shared temporary directory and a code coverage driver, but poses a significant risk in multi-user environments where local access is granted to untrusted parties.
We recommend you to update PHPUnit to version 13.4.4.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]