CVEssebastianbergmannCVE-2026-119193Published Oct 29, 19:35 · Updated Oct 30, 16:09 UTC
5.4
MediumCVSS 4.0 · from GitHub_M
CVE-2026-119193

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

phpunit · CWE-379 · CWE-379
Affectedphpunit
FixNo fix listed yet.
PublishedOct 29, 19:35 · GitHub_M
ScoredOct 29 · 5.4 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.

Description

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed inphpunit>= 13.4.0, < 13.4.4–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf · github.comrefsource_CONFIRMgithub.com/sebastianbergmann/phpunit/commit/ae31c78a86e9d6c641497bacf47462d7bb7d7f34 · github.comrefsource_MISCgithub.com/sebastianbergmann/phpunit/releases/tag/13.4.4 · github.comrefsource_MISC

Other CVEs in phpunit

All 2 →
7.8PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes · CVE-2026-41570May 87.8PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling · CVE-2026-24765Jan 27