Junglewise Threat Intelligence

CVE-2026-10273: PHP Censor OS command injection in Webhook Endpoint

CVE-2026-10273 · Severity: high · CVSS 7.3 · Published 2026-06-01

Executive brief

PHP Censor, an open-source continuous integration server, contains a critical security flaw in its webhook handling component. An unauthenticated attacker can send a specially crafted request to the server to execute arbitrary system commands. This could lead to a complete takeover of the server, unauthorized access to source code, or disruption of the automated build process.

Technical details

A critical OS command injection vulnerability (CWE-78) exists in PHP Censor up to version 2.1.6. The WebhookController is explicitly whitelisted from authentication checks in src/Application.php, allowing unauthenticated access to the webhook endpoint. Parameters such as 'branch' and 'commitId' from the webhook request are passed unsanitized into shell command strings (e.g., git checkout, git clone) via sprintf() and executed using Symfony's Process::fromShellCommandline(). Because this method interprets shell metacharacters, an attacker can inject arbitrary commands by crafting a request to /webhook/git/<projectId> with malicious arguments. A patch has been released (commit cd68d10 and ae24ef5) that implements escapeshellarg() to neutralize these injection vectors.

Affected products

  • php-censor PHP Censor up to 2.1.6

Timeline

  • 2026-05-11: disclosed: Issue reported and pull request submitted on GitHub
  • 2026-05-11: patched: Fixes merged into master branch
  • 2026-06-01: advisory: CVE published to NVD

References