{"id":"CVE-2026-44262","aliases":["EUVD-2026-29846","GHSA-4rm2-28vj-fj39"],"status":"published","title":"Scramble: Remote code execution via evaluation of user-controlled input in validation rules","description":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0586,"percentile":0.9329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-05-06T19:54:56Z","modified":"2026-10-28T02:30:25Z","exploits":[{"source":"exploitdb","id":"EDB-52582","title":"scramble - Remote Code Execution","type":"webapps","platform":"php","date":"2026-05-27","url":"https://www.exploit-db.com/exploits/52582"},{"source":"nuclei","id":"CVE-2026-44262","title":"Scramble Laravel - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44262.yaml"},{"source":"pocgithub","id":"akash-osmsec/CVE-2026-44262-","title":"akash-osmsec/CVE-2026-44262-","date":"2026-07-18","url":"https://github.com/akash-osmsec/CVE-2026-44262-"},{"source":"pocgithub","id":"joshuavanderpoll/CVE-2026-44262","title":"joshuavanderpoll/CVE-2026-44262","date":"2026-05-07","url":"https://github.com/joshuavanderpoll/CVE-2026-44262"}],"fixes":[{"ecosystem":"Packagist","package":"dedoc/scramble","fixed_in":["0.13.22"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"dedoc/scramble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.2"},{"last_affected":"0.13.21"},{"fixed":"0.13.22"}]}]},{"source":"osv","ecosystem":"Packagist","package":"dedoc/scramble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.2"},{"fixed":"0.13.22"}]}],"versions":["v0.13.10","v0.13.11","v0.13.12","v0.13.13","v0.13.14","v0.13.15","v0.13.16","v0.13.17","v0.13.18","v0.13.19","v0.13.2","v0.13.20","v0.13.21","v0.13.3","v0.13.4","v0.13.5","v0.13.6","v0.13.7","v0.13.8","v0.13.9"]}],"products":[{"vendor":"dedoc","product":"scramble"}],"references":[{"url":"https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/dedoc/scramble/releases/tag/v0.13.22","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44262","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4rm2-28vj-fj39"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44262.json","tags":["advisory"]},{"url":"https://github.com/dedoc/scramble","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44262","title":"Scramble: Remote code execution via evaluation of user-controlled input in validation rules","description":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","status":"published","published":"2026-05-12T20:56:01.046Z","modified":"2026-05-13T14:53:20.142Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-29846","description":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","status":"published","published":"2026-05-12T20:56:01Z","modified":"2026-05-13T14:53:20Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T19:04:33.75998Z"}],"ghsa":[{"id":"GHSA-4rm2-28vj-fj39","title":"Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules","description":"### Impact\n\nA remote code execution (RCE) vulnerability affects versions `0.13.2` through `0.13.21`. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.\n\n### Patches\n\nFixed in version `0.13.22`.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Restrict access to documentation endpoints (`/docs/api`, `/docs/api.json`)\n* Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)\n* Disable documentation endpoints in production environments if not required\n\nThese measures significantly reduce or prevent exploitability.","status":"published","published":"2026-05-06T19:54:56Z","modified":"2026-05-13T16:41:48Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44262","description":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","status":"published","published":"2026-05-12T22:16:36.563Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:18.613259Z"}],"osv":[{"id":"CVE-2026-44262","title":"Scramble: Remote code execution via evaluation of user-controlled input in validation rules","description":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","status":"published","published":"2026-05-12T20:56:01.046Z","modified":"2026-10-28T02:30:25.471540822Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-4rm2-28vj-fj39","title":"Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules","description":"### Impact\n\nA remote code execution (RCE) vulnerability affects versions `0.13.2` through `0.13.21`. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.\n\n### Patches\n\nFixed in version `0.13.22`.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n* Restrict access to documentation endpoints (`/docs/api`, `/docs/api.json`)\n* Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)\n* Disable documentation endpoints in production environments if not required\n\nThese measures significantly reduce or prevent exploitability.","status":"published","published":"2026-05-06T19:54:56Z","modified":"2026-05-13T16:57:27.482589Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}