PT-2025-30581 · Xdebug+1 · Xdebug+1

Published 2025-07-23 · Updated 2025-07-23 · CVE-2015-10141

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Xdebug versions 2.5.5 and earlier

Description An unauthenticated OS command injection vulnerability exists in Xdebug, a PHP debugging extension. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, potentially invoking system-level functions such as system() or passthru(). This can lead to a full compromise of the host with the privileges of the web server user.

Recommendations Update Xdebug to a version later than 2.5.5.

Fix

Missing Authentication

OS Command Injection

Weakness Enumeration

CWE-306

CWE-78

Related Identifiers

CVE-2015-10141

Affected Products

Debian

Xdebug

References · 14

• https://ubuntu.com/security/CVE-2015-10141 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-10141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-10141 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-10141 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-10141 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-10141 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-10141 · Vendor Advisory
• https://fortiguard.com/encyclopedia/ips/46000 · Note
• https://xdebug.org · Note
• https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers · Note
• https://vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution · Note
• https://t.me/CVEtracker/28488 · Telegram Post
• https://exploit-db.com/exploits/44568 · Note
• http://web.archive.org/web/20231226215418/https://paper.seebug.org/397 · Note