PT-2026-38297 · Scramble · Scramble

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-44262

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Scramble versions 0.13.2 through 0.13.21

Description When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation. This can lead to remote code execution (RCE), allowing arbitrary PHP code to be executed within the application context.

Recommendations Update to version 0.13.22. Restrict access to the endpoints "/docs/api" and "/docs/api.json". Avoid using user-controlled variables inside validation rule expressions. Disable documentation endpoints in production environments if they are not required.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-44262

GHSA-4RM2-28VJ-FJ39

Affected Products

Scramble

References · 8

• 🔥 https://exploit-db.com/exploits/52582 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44262 · Security Note
• https://osv.dev/vulnerability/GHSA-4rm2-28vj-fj39 · Vendor Advisory
• https://github.com/dedoc/scramble/releases/tag/v0.13.22 · Note
• https://github.com/dedoc/scramble · Note
• https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39 · Note
• https://t.me/CVEtracker/53557 · Telegram Post
• https://twitter.com/CVEnew/status/2054324002131497399 · Twitter Post