jvoisin snuffleupagus up to 0.12.x POST Request failing open

Summaryinfo

A vulnerability was found in jvoisin snuffleupagus up to 0.12.x. It has been classified as critical. Affected by this issue is some unknown functionality of the component POST Request Handler. The manipulation leads to failing open. This vulnerability is documented as CVE-2026-22034. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in jvoisin snuffleupagus up to 0.12.x. This issue affects an unknown code block of the component POST Request Handler. The manipulation with an unknown input leads to a failing open vulnerability. Using CWE to declare the problem leads to CWE-636. When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-22034 since 01/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.13.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• jvoisin

Name

• snuffleupagus

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12

Website

• Product: https://github.com/jvoisin/snuffleupagus/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion