CVE-2026-22034

{"id": "CVE-2026-22034", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22034", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-08T15:06:01.257688Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jvoisin", "product": "snuffleupagus", "versions": [{"status": "affected", "version": "< 0.13.0"}]}]}], "published": "2026-01-08T15:15:45.150", "references": [{"url": "https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://snuffleupagus.readthedocs.io/config.html#upload-validation", "tags": ["Product"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-636"}]}], "descriptions": [{"lang": "en", "value": "Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0."}, {"lang": "es", "value": "Snuffleupagus es un m\u00f3dulo que eleva el coste de los ataques contra sitios web eliminando clases de errores y proporcionando un sistema de parcheo virtual. En despliegues de Snuffleupagus anteriores a la versi\u00f3n 0.13.0 con la caracter\u00edstica de validaci\u00f3n de subida no predeterminada habilitada y configurada para usar uno de los scripts de validaci\u00f3n ascendentes basados en Vulcan Logic Disassembler (VLD) mientras la extensi\u00f3n VLD no est\u00e1 disponible para la SAPI CLI, todos los archivos de las solicitudes POST multipart se eval\u00faan como c\u00f3digo PHP. El problema se solucion\u00f3 en la versi\u00f3n 0.13.0."}], "lastModified": "2026-06-17T10:19:23.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jvoisin:snuffleupagus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27E48E9D-66B6-409E-8510-A8770570D1A4", "versionEndExcluding": "0.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}