PT-2026-2140 · Unknown · Snuffleupagus+1

Thomas-Chauchefoin-Tob · Publicado 2026-01-08 · Atualizado 2026-03-09 · CVE-2026-22034

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snuffleupagus versions prior to 0.13.0

Description Snuffleupagus is a module designed to increase the cost of attacks against websites by eliminating bug classes and offering a virtual patching system. In deployments of Snuffleupagus before version 0.13.0, if the non-default upload validation feature is enabled and configured to utilize one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is unavailable to the CLI SAPI, all files received in multipart POST requests are treated as PHP code. This could lead to remote code execution.

Recommendations Versions prior to 0.13.0 should be updated to version 0.13.0 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-636

Identificadores relacionados

CVE-2026-22034

GHSA-C4CH-XW5P-2MVC

Produtos afetados

Snuffleupagus

Vulcan Logic Disassembler

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22034.json · Exploit
• 🔥 https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc · Exploit
• https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274 · Nota
• https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166 · Nota
• https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100 · Nota
• https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php · Nota
• https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py · Nota
• https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37 · Correção
• https://snuffleupagus.readthedocs.io/config.html#upload-validation · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22034 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-22034 · Aviso do Fabricante
• https://t.me/CVEtracker/41729 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009291497640767918 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22034 · Nota de Segurança
• https://t.me/cveNotify/154792 · Publicação no Telegram