CVE-2026-22034 Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
Attackers can execute arbitrary PHP code via multipart POST requests if upload validation is enabled without the VLD extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22034?
CVE-2026-22034 is a critical code injection vulnerability in jvoisin snuffleupagus, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
Weakness: CWE-636
Which versions are affected by CVE-2026-22034?
It affects 1 product.
Products include Jvoisin Snuffleupagus.
How do I fix CVE-2026-22034?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-22034 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22034 exists.
Sources
Also known as DEBIAN-CVE-2026-22034, GHSA-c4ch-xw5p-2mvc.