CVE-2026-41570 PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Attackers can inject arbitrary PHP INI directives via newlines in forwarded settings, leading to remote code execution in child processes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41570?
CVE-2026-41570 is a high-severity command injection vulnerability in sebastianbergmann phpunit, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.
Which versions are affected by CVE-2026-41570?
4 open source packages ship an affected version, including phpunit/phpunit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpunit/phpunit Packagist | From 12.5.21 | 12.5.22 |
phpunit/phpunit Packagist | From 12.5.21 | 12.5.22 |
phpunit/phpunit Packagist | From 13.1.5 | 13.1.6 |
phpunit/phpunit Packagist | From 13.1.5 | 13.1.6 |
Products include Phpunit Project Phpunit.
How do I fix CVE-2026-41570?
Upgrade phpunit/phpunit to a fixed version for your release line: 12.5.22 or 13.1.6.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-41570 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41570 exists.
Other vulnerabilities in sebastianbergmann phpunit
Sources
Also known as GHSA-qrr6-mg7r-m243, UBUNTU-CVE-2026-41570.