CVE-2026-46420: shivammathur setup-php command injection in PHP version resolution

CVE-2026-46420 · Severity: medium · CVSS 5.6 · Published 2026-07-17

shivammathur/setup-php is a popular GitHub Action used to configure PHP environments for automated software testing and deployment. A security flaw allows attackers to execute unauthorized commands on the build server by placing malicious code inside common configuration files like composer.json or .php-version. This is particularly dangerous for projects that automatically process pull requests from external contributors, as it could lead to the theft of secrets or unauthorized access to the build environment.

Vendors: GitHub Actions.

Quick answers

Is CVE-2026-46420 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46420 being exploited in the wild.
How severe is CVE-2026-46420?
Medium severity, with a CVSS score of 5.6, published 17 July 2026.
Which products and versions are affected?
shivammathur/setup-php (GitHub Actions) >= 2.25.0, < 2.37.1; Shivam Mathur Setup-Php >= 2.25.0, < 2.37.1.
Is there a fix for CVE-2026-46420?
A patch was published on 2026-05-14: Version 2.37.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46420 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46420?
Check whether you run shivammathur/setup-php (GitHub Actions) or Shivam Mathur Setup-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in shivammathur/setup-php versions 2.25.0 through 2.37.0. The action resolves PHP versions from repository files including .php-version, composer.lock, and composer.json without sufficient sanitization. These values are subsequently incorporated into generated shell or PowerShell setup scripts. An attacker can exploit this by submitting a pull request containing a malicious version string in these files. If the workflow (e.g., pull_request_target) checks out the untrusted code before running setup-php, the injected commands will execute on the GitHub Actions runner. The issue is fixed in version 2.37.1 by implementing stricter input validation and hardening script generation.

Affected products

  • shivammathur setup-php >= 2.25.0, < 2.37.1

Identifiers

  • CVE-2026-46420
  • GHSA-pqwm-q9pv-ph8r

Timeline

  • 2026-05-14: patched: Version 2.37.1 released
  • 2026-05-14: advisory: GitHub Security Advisory GHSA-pqwm-q9pv-ph8r published
  • 2026-07-17: disclosed: CVE-2026-46420 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.