PT-2026-45449 · Git · Php-Censor

Anch0R · CVE-2026-10273 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions php-censor versions prior to 2.1.7

Description An OS command injection flaw exists in the Webhook Endpoint component within the file src/Model/Build/GitBuild.php. A remote attacker can trigger this issue by manipulating the commitId argument, allowing for the execution of arbitrary operating system commands.

Recommendations Apply patch cd68d102601320bd319d590b75f7652e66f0685f to resolve the issue in versions prior to 2.1.7.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-10273

Affected Products

Php-Censor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10273.json · Exploit
• 🔥 https://github.com/php-censor/php-censor/pull/441 · Exploit
• 🔥 https://github.com/php-censor/php-censor/issues/442 · Exploit
• https://github.com/php-censor/php-censor/commit/cd68d102601320bd319d590b75f7652e66f0685f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10273 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10273 · Vendor Advisory
• https://vuldb.com/vuln/367552 · Note
• https://vuldb.com/vuln/367552/cti · Note
• https://github.com/php-censor/php-censor · Note
• https://vuldb.com/cve/CVE-2026-10273 · Note
• https://vuldb.com/submit/825315 · Note