Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119193— PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Quick assessment

Affected
sebastianbergmann phpunit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHPUnit 是一个用于 PHP 的测试框架。在 13.4.0 至 13.4.4 版本中， 文件中的 逻辑会在 下创建一个可预测的 目录，用于存放 PHPT 代码覆盖率的临时文件，并在未验证该目录所有权或权限的情况下重复使用该目录。在共享临时路径的多用户系统上，本地攻击者可以在开发者运行带代码覆盖率的 PHPT 测试之前预先创建该目录，从而在子进程通过 执行生成的任务文件之前替换该文件，进而以开发者的权限执行任意代码，同时测试过程和覆盖率报告仍显示为成功。PHPUnit 12.5 及更早版本、macOS 和 Wi

CVSS 5.4 · Medium EPSS 0.11% · P1

Possible ATT&CK Techniques 1 AI

T1203.001

Affected Version Matrix 1

VendorProduct Version RangeStatus
sebastianbergmann phpunit >= 13.4.0, < 13.4.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119193

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
Source: CVE Program / CVE List V5
Vulnerability Description
PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在具有不安全权限的目录中创建临时文件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sebastianbergmann phpunit >= 13.4.0, < 13.4.4 -

II. Public POCs for CVE-2026-119193

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119193

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119193 (1)

Vendor Pages for CVE-2026-119193 (1)

IV. Related Vulnerabilities

Same product: phpunit
Same vendor: sebastianbergmann
Same weakness: CWE-379