CVE-2026-22034
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Jan 8, 2026
CISA due date
—
The record
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
- CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636
- CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-636
- CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a… CWE-636
- CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor… CWE-636
- CVE-2026-46482 ### Impact The registration component does not validate the text-based _Security… CWE-636
- CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows… CWE-636
- CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-636