Is CVE-2026-119193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119193 being exploited in the wild.

How severe is CVE-2026-119193?

Medium severity, with a CVSS score of 4, published 29 October 2026.

Which products and versions are affected?

phpunit/phpunit (Packagist) >= 13.4.0, < 13.4.4, ECOSYSTEM:introduced=13.4.0,fixed=13.4.4; Sebastianbergmann PHPUnit 13.4.0 through 13.4.3.

How is CVE-2026-119193 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-119193?

Check whether you run phpunit/phpunit (Packagist) or Sebastianbergmann PHPUnit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119193: PHPUnit predictable temp directory in code coverage for PHPT tests

Q: Is there a fix for CVE-2026-119193?

Yes. phpunit/phpunit (Packagist): upgrade to 13.4.4 or later. Until then: On multi-user systems with shared temporary directories, restrict access to the temporary path so only the current user can create files there, or use PHPUnit 12.5 or earlier which are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119193 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-119193?

Check whether you run phpunit/phpunit (Packagist) or Sebastianbergmann PHPUnit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119193 · Severity: medium · CVSS 4 · Published 2026-10-29

PHPUnit is a testing framework used by PHP developers to verify code quality. Versions 13.4.0 through 13.4.3 create code coverage files in a predictable temporary directory on multi-user systems. A local attacker can create this directory first and replace the test files before they execute, allowing them to run arbitrary code with the developer's privileges while making the test appear to pass.

Technologies: phpunit/phpunit (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-119193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119193 being exploited in the wild.
How severe is CVE-2026-119193?: Medium severity, with a CVSS score of 4, published 29 October 2026.
Which products and versions are affected?: phpunit/phpunit (Packagist) >= 13.4.0, < 13.4.4, ECOSYSTEM:introduced=13.4.0,fixed=13.4.4; Sebastianbergmann PHPUnit 13.4.0 through 13.4.3.
Is there a fix for CVE-2026-119193?: Yes. phpunit/phpunit (Packagist): upgrade to 13.4.4 or later. Until then: On multi-user systems with shared temporary directories, restrict access to the temporary path so only the current user can create files there, or use PHPUnit 12.5 or earlier which are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119193 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-119193?: Check whether you run phpunit/phpunit (Packagist) or Sebastianbergmann PHPUnit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpunit/phpunit (Packagist): upgrade to 13.4.4 or later
```
composer require phpunit/phpunit:^13.4.4
```

On multi-user systems with shared temporary directories, restrict access to the temporary path so only the current user can create files there, or use PHPUnit 12.5 or earlier which are not affected.

Technical details

The TestCase::coverageFilesDirectory() method in PHPUnit creates temporary files for PHPT code coverage in a predictable directory (phpunit-phpt) under sys_get_temp_dir() without verifying ownership or permissions. On multi-user systems with shared temp paths, a local attacker can pre-create the directory and replace the job file before the child process executes it with require(). The vulnerability affects versions 13.4.0–13.4.3 on multi-user Unix-like systems but not Windows, macOS defaults, or single-user environments.

Affected products

sebastianbergmann PHPUnit 13.4.0 through 13.4.3

Identifiers

CVE-2026-119193
GHSA-9vw2-f4vp-x7gf

Timeline

2026-10-29: disclosed
2026-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.