CVE Explorer

CVE-2026-24765

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ace7f63b547f29b68ecb1c617ea62c45bae1694417254f4af7f0836e8f65a702

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"phpunit","vendor":"sebastianbergmann","versions":[{"status":"affected","version":"< 8.5.52"},{"status":"affected","version":">= 9.0.0, < 9.6.33"},{"status":"affected","version":">= 10.0.0, < 10.5.62"},{"status":"affected","version":">= 11.0.0, < 11.5.50"},{"status":"affected","version":">= 12.0.0, < 12.5.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/problemTypes/0/descriptions/0

Source references

8 source assertions

{"name":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/1

{"name":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/2

{"name":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/3

{"name":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/4

{"name":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/5

{"name":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","tags":["x_refsource_MISC"],"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/6

{"name":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/cna/references/0

{"url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84d70bce8498747985ffc5b3668ee4af1b3f5c8ee8fbc1a4806c56580f6cb5a0 · sha256:0baf5a2ca7644ed3… · /containers/adp/1/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer