Critical severity9.8OSV Advisory· Published Jan 8, 2026· Updated Jun 17, 2026
CVE-2026-22034
CVE-2026-22034
Description
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4v0.1.0, v0.10.0, v0.11.0, …+ 2 more
- (no CPE)range: v0.1.0, v0.10.0, v0.11.0, …
- cpe:2.3:a:jvoisin:snuffleupagus:*:*:*:*:*:*:*:*range: <0.13.0
- (no CPE)range: <0.13.0
- Range: <0.13.0
Patches
Vulnerability mechanics
References
8- github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37nvdPatch
- github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvcnvdExploitPatchVendor Advisory
- github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.cnvdProduct
- github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.phpnvdProduct
- github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.pynvdProduct
- github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.cnvdProduct
- github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.cnvdProduct
- snuffleupagus.readthedocs.io/config.htmlnvdProduct
News mentions
0No linked articles in our index yet.