bobthecow psysh up to 0.11.22/0.12.18 .psysh.php uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in bobthecow psysh up to 0.11.22/0.12.18. Affected by this vulnerability is an unknown functionality of the file .psysh.php. The manipulation leads to uncontrolled search path. This vulnerability is documented as CVE-2026-25129. The attack needs to be performed locally. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in bobthecow psysh up to 0.11.22/0.12.18. This issue affects some unknown functionality of the file .psysh.php. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation. This is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious `.psysh.php`, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation. Downstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (`php artisan tinker`) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the `.psysh.php` auto-load behavior can be abused in the same way to execute attacker-controlled code under the victim’s privileges. Versions 0.11.23 and 0.12.19 patch the issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-25129 since 01/29/2026. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

By approaching the search of inurl:.psysh.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.11.23 or 0.12.19 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-5009). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• bobthecow

Name

• psysh

Version

• 0.11.0
• 0.11.1
• 0.11.2
• 0.11.3
• 0.11.4
• 0.11.5
• 0.11.6
• 0.11.7
• 0.11.8
• 0.11.9
• 0.11.10
• 0.11.11
• 0.11.12
• 0.11.13
• 0.11.14
• 0.11.15
• 0.11.16
• 0.11.17
• 0.11.18
• 0.11.19
• 0.11.20
• 0.11.21
• 0.11.22
• 0.12.0
• 0.12.1
• 0.12.2
• 0.12.3
• 0.12.4
• 0.12.5
• 0.12.6
• 0.12.7
• 0.12.8
• 0.12.9
• 0.12.10
• 0.12.11
• 0.12.12
• 0.12.13
• 0.12.14
• 0.12.15
• 0.12.16
• 0.12.17
• 0.12.18

Website

• Product: https://github.com/bobthecow/psysh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion