Cloudanix VulnDB

GHSA-qrr6-mg7r-m243

High · 7.8

PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

CVSS

7.8

EPSS

—

Published

Apr 18, 2026

CISA due date

—

The record

PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled path yields remote code execution in the child process. Sources of INI values that participate in the attack: - `<ini name="…" value="…"/>` entries in `phpunit.xml` / `phpunit.xml.dist` - INI settings inherited from the host PHP runtime via `ini_get_all()`

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities