PT-2026-2140 · Unknown · Snuffleupagus+1

Thomas-Chauchefoin-Tob · Published 2026-01-08 · Updated 2026-03-09 · CVE-2026-22034

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snuffleupagus versions prior to 0.13.0

Description Snuffleupagus is a module designed to increase the cost of attacks against websites by eliminating bug classes and offering a virtual patching system. In deployments of Snuffleupagus before version 0.13.0, if the non-default upload validation feature is enabled and configured to utilize one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is unavailable to the CLI SAPI, all files received in multipart POST requests are treated as PHP code. This could lead to remote code execution.

Recommendations Versions prior to 0.13.0 should be updated to version 0.13.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-22034

GHSA-C4CH-XW5P-2MVC

Affected Products

Snuffleupagus

Vulcan Logic Disassembler

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22034.json · Exploit
• 🔥 https://github.com/jvoisin/snuffleupagus/security/advisories/GHSA-c4ch-xw5p-2mvc · Exploit
• https://github.com/jvoisin/snuffleupagus/commit/9278dc77bab2a219e770a1b31dd6797bc9070e37 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22034 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22034 · Vendor Advisory
• https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/main/rfc1867.c#L1269-L1274 · Note
• https://github.com/php/php-src/blob/e4098da58a9eaee759d728d98a27d809cde37671/ext/standard/dl.c#L165-L166 · Note
• https://github.com/jvoisin/snuffleupagus/blob/9278dc77bab2a219e770a1b31dd6797bc9070e37/src/sp_upload_validation.c#L92-L100 · Note
• https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.php · Note
• https://github.com/jvoisin/snuffleupagus/blob/v0.12.0/scripts/upload_validation.py · Note
• https://snuffleupagus.readthedocs.io/config.html#upload-validation · Note
• https://t.me/CVEtracker/41729 · Telegram Post
• https://twitter.com/CVEnew/status/2009291497640767918 · Twitter Post