CVE-2026-119193 in PHPUnit
Summary
by MITRE • 10/29/2026
PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in PHP Unit versions ranging from 13.4.0 to 13.4.4 represents a critical insecure temporary file creation flaw that compromises system integrity through predictable resource allocation and insufficient access control checks. This issue specifically affects the TestCase::coverageFilesDirectory() logic located within the src/Runner/Phpt/TestCase.php module, which is responsible for managing code coverage data during PHPT test execution. The core technical deficiency lies in the framework's decision to generate temporary files inside a directory named phpunit-phpt situated directly under the system-wide temporary directory returned by sys_get_temp_dir(). Crucially, this implementation fails to verify the ownership or permissions of the target directory before proceeding with file operations. In environments where multiple users share access to the same temporary path, such as many Linux server configurations, this design choice creates a race condition and privilege escalation vector that can be exploited by local attackers seeking to execute arbitrary code under the context of the developer running the tests.
The operational impact of this vulnerability is severe, enabling an attacker with local system access to achieve remote code execution equivalent to the privileges of the user executing PHPUnit. The attack mechanism relies on the predictability of the directory name and path. An adversary can pre-create the phpunit-phpt directory within the shared temporary space before the developer initiates a test suite that utilizes PHPT tests with code coverage enabled. Once this directory exists, the attacker gains control over any subsequent file creation operations directed to that location by PHPUnit. The framework subsequently attempts to write job files into this directory and executes them using PHP's require function. Because the attacker controls the contents of these files due to their prior creation of the parent directory, they can inject malicious payloads that are executed with full developer privileges. This allows for complete system compromise while maintaining stealth, as the test suite appears to run successfully and generates a standard coverage report, thereby masking the unauthorized code execution from immediate detection by the user or automated monitoring systems.
This vulnerability is classified under CWE-377, which describes insecure temporary file creation, specifically highlighting the risks associated with predictable filenames in shared directories. It also aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it facilitates arbitrary code execution through script injection via require statements. The risk is mitigated by environmental factors that limit user interaction; for instance, default configurations on macOS and Windows typically utilize per-user temporary directories where other users cannot create files or directories within the same path. Similarly, single-user environments are not affected because there is no possibility of a concurrent local attacker creating conflicting resources in the temporary space. However, any multi-user system with shared /tmp access remains highly vulnerable if these specific versions of PHPUnit are used for PHPT testing with coverage enabled.
To mitigate this vulnerability, organizations and developers must immediately upgrade to PHP Unit version 13.4.4 or later, where the issue has been resolved by implementing secure temporary file handling practices such as using mkdtemp for atomic directory creation with restricted permissions. In environments where upgrading is not immediately feasible, administrators should enforce strict umask settings that prevent other users from creating directories in shared temp paths and consider disabling PHPT code coverage features if they are not strictly required during test execution. Additionally, running test suites under isolated user accounts or containers can further reduce the attack surface by ensuring that temporary file operations occur within sandboxed environments where cross-user interference is impossible. Regular auditing of third-party library dependencies for similar insecure temp file patterns is also recommended to prevent analogous vulnerabilities in other components of the software supply chain.