Code Execution Vulnerability in PHPUnit Testing Framework by Sebastian Bergmann

CVE-2026-119193

What is CVE-2026-119193?

The PHPUnit testing framework version 13.4.0 to 13.4.4 has a vulnerability in the TestCase::coverageFilesDirectory() method. It generates temporary files in the predictable phpunit-phpt directory without proper checks for ownership or permissions. This flaw can be exploited on multi-user systems by a local attacker who creates the directory before tests are run. By doing so, the attacker can manipulate the job file utilized by the test process, leading to arbitrary code execution under the developer's privileges, while seemingly successful test and coverage reports are generated. This issue has been resolved in version 13.4.4.

References