{"id":"CVE-2026-46420","aliases":["EUVD-2026-45303","GHSA-pqwm-q9pv-ph8r"],"status":"published","title":"setup-php: Command Injection in Repository-Derived PHP Version Resolution","description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0201,"percentile":0.81124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2026-05-20T15:31:52Z","modified":"2026-10-28T02:30:49Z","exploits":[{"source":"pocgithub","id":"Jvr2022/CVE-2026-46420","title":"Jvr2022/CVE-2026-46420","date":"2026-07-18","url":"https://github.com/Jvr2022/CVE-2026-46420"}],"fixes":[{"ecosystem":"GitHub Actions","package":"shivammathur/setup-php","fixed_in":["2.37.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"shivammathur/setup-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.0"},{"fixed":"2.37.1"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"shivammathur/setup-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.0"},{"fixed":"2.37.1"}]}]}],"products":[{"vendor":"shivammathur","product":"setup-php"},{"vendor":"shivammathur","product":"setup_php"}],"references":[{"url":"https://github.com/shivammathur/setup-php/security/advisories/GHSA-pqwm-q9pv-ph8r","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/shivammathur/setup-php/commit/eeef37e059fb5368a5bc8ed8ce45ff54bd39b80b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/shivammathur/setup-php/releases/tag/2.37.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-pqwm-q9pv-ph8r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46420.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46420","tags":["advisory"]},{"url":"https://github.com/shivammathur/setup-php","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46420","title":"setup-php: Command Injection in Repository-Derived PHP Version Resolution","description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","status":"published","published":"2026-07-17T19:51:10.253Z","modified":"2026-07-20T18:15:56.324Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-45303","description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","status":"published","published":"2026-07-17T19:51:10Z","modified":"2026-07-20T18:15:56Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:19:48.530346Z"}],"ghsa":[{"id":"GHSA-pqwm-q9pv-ph8r","title":"Setup PHP: Command Injection in Repository-Derived PHP Version Resolution","description":"### Summary\n\nA command injection vulnerability was identified in `shivammathur/setup-php` when the action resolves the PHP version from repository-controlled files and uses that value while generating the platform setup script.\n\nIn affected versions, `setup-php` may read the PHP version from:\n\n- `.php-version`\n- `composer.lock` via `platform-overrides.php`\n- `composer.json` via `config.platform.php`\n\nIf an attacker can influence one of these files and the workflow executes `setup-php` in a trusted context, they may be able to execute commands on the GitHub Actions runner.\n\n### Impact\n\nThis issue is exploitable when `setup-php` is run after checking out attacker-controlled repository contents and resolves the PHP version from repository files.\n\nThe most significant example is a privileged workflow such as `pull_request_target` that checks out untrusted pull request code before invoking `setup-php`. Similar risk can also arise in other workflows that operate on attacker-controlled refs, branches, or repository contents in a trusted context.\n\nThis is not a separate security boundary when an attacker can already modify the workflow definition itself or directly control the `php-version` workflow input, since that level of access already permits arbitrary command execution in GitHub Actions.\n\n### Technical details\n\nIn affected versions, repository-derived PHP version values were insufficiently constrained before being incorporated into the generated shell or PowerShell setup script executed by the action. This could allow attacker-controlled values from supported repository files to influence script execution in trusted workflow contexts.\n\n### Remediation\n\nIf you are using `shivammathur/setup-php@v2`, no action is needed on your end. Users who pin the setup-php release version or release version SHA should upgrade to a patched version.\n\nThe fix validates PHP version inputs, constrains manifest-derived versions, hardens script generation at the execution, and includes additional checks in related input-handling paths.","status":"published","published":"2026-05-20T15:31:52Z","modified":"2026-05-20T15:31:53Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2026-46420","description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","status":"published","published":"2026-07-17T20:17:18.567Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-46420","title":"setup-php: Command Injection in Repository-Derived PHP Version Resolution","description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","status":"published","published":"2026-07-17T19:51:10.253Z","modified":"2026-10-28T02:30:49.424837689Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"GHSA-pqwm-q9pv-ph8r","title":"Setup PHP: Command Injection in Repository-Derived PHP Version Resolution","description":"### Summary\n\nA command injection vulnerability was identified in `shivammathur/setup-php` when the action resolves the PHP version from repository-controlled files and uses that value while generating the platform setup script.\n\nIn affected versions, `setup-php` may read the PHP version from:\n\n- `.php-version`\n- `composer.lock` via `platform-overrides.php`\n- `composer.json` via `config.platform.php`\n\nIf an attacker can influence one of these files and the workflow executes `setup-php` in a trusted context, they may be able to execute commands on the GitHub Actions runner.\n\n### Impact\n\nThis issue is exploitable when `setup-php` is run after checking out attacker-controlled repository contents and resolves the PHP version from repository files.\n\nThe most significant example is a privileged workflow such as `pull_request_target` that checks out untrusted pull request code before invoking `setup-php`. Similar risk can also arise in other workflows that operate on attacker-controlled refs, branches, or repository contents in a trusted context.\n\nThis is not a separate security boundary when an attacker can already modify the workflow definition itself or directly control the `php-version` workflow input, since that level of access already permits arbitrary command execution in GitHub Actions.\n\n### Technical details\n\nIn affected versions, repository-derived PHP version values were insufficiently constrained before being incorporated into the generated shell or PowerShell setup script executed by the action. This could allow attacker-controlled values from supported repository files to influence script execution in trusted workflow contexts.\n\n### Remediation\n\nIf you are using `shivammathur/setup-php@v2`, no action is needed on your end. Users who pin the setup-php release version or release version SHA should upgrade to a patched version.\n\nThe fix validates PHP version inputs, constrains manifest-derived versions, hardens script generation at the execution, and includes additional checks in related input-handling paths.","status":"published","published":"2026-05-20T15:31:52Z","modified":"2026-05-20T15:56:29.32162Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}