CVE-2026-22034: Snuffleupagus remote code execution via upload validation without VLD
Snuffleupagus, a PHP security module, can evaluate every file from multipart POST requests as PHP code when upload validation is enabled with a VLD-based upstream script and the VLD extension is unavailable to the CLI SAPI. The issue affects versions before 0.13.0 and is fixed in 0.13.0. The record reports CVSS 3.1 9.8 from NVD, and no confirmed exploitation appears in the sources consulted.
Overview
Snuffleupagus is a PHP security module that adds virtual patching and hardening against common bug classes. According to the record, the flaw appears only when upload validation, a non-default feature, is enabled and configured to use an upstream script based on the Vulcan Logic Disassembler (VLD), while the VLD extension is not available to the CLI SAPI. Under those conditions, files from multipart POST requests are evaluated as PHP code.
Impact
The NVD record lists a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Because the description states that uploaded files are evaluated as PHP code, the practical consequence is remote code execution on the web server (inference from the description). The record classifies the weakness as CWE-636, but no CWE name is provided.
Affected products and versions
- Product: Jvoisin Snuffleupagus
- Affected range: before 0.13.0, and only in the configuration described above (non-default upload validation with a VLD-based script and no VLD extension on the CLI SAPI)
- Fixed version: 0.13.0
The record does not list other affected branches or intermediate releases, so their status is unknown.
Exploitation status
The CISA KEV catalog entry in the record is marked as not listed, so this analysis does not state that the vulnerability is exploited in the wild. No confirmed exploitation appears in the sources consulted. The vendor advisory carries an 'Exploit' tag in its reference metadata, but the record does not explain what that tag refers to, so its meaning is unknown. The SSVC data in the record indicates a proof-of-concept exploitation level and automatable status, which is a planning signal and not a confirmed attack. The EPSS value in the record is 0.00714 (percentile 0.53156).
Remediation and mitigation
- Upgrade Snuffleupagus to version 0.13.0 or later, as the vendor advisory and commit indicate.
- Until upgrading is possible, review whether upload validation is enabled and whether it uses a VLD-based upstream script. Disabling the feature or restoring the VLD extension on the CLI SAPI reduces exposure, but the record does not confirm either as an official workaround, so this is an inference.
- Audit web servers for recently added or modified files in upload directories and in paths reachable by PHP.
Detection guidance
- Review web server and PHP logs for multipart POST requests that coincide with unexpected file creation or unusual PHP process activity.
- Check file integrity monitoring on web roots and upload directories for unexpected PHP files.
- Confirm the installed Snuffleupagus version and the presence of the upload validation configuration in every PHP environment, including CLI-based tooling.
Limitations of the available information
The record does not include detailed technical reproduction information, which this analysis deliberately omits. It does not state the exact conditions beyond those in the description, does not provide a CWE name, and does not confirm whether any vendor-provided workaround exists besides the fix. The EPSS date in the record (2026-10-23) is later than the publication date and should be verified against the source before being relied on for prioritization.
Frequently asked questions
Which Snuffleupagus versions are affected by CVE-2026-22034?
According to the record, versions before 0.13.0 are affected, but only when upload validation is enabled with a VLD-based upstream script and the VLD extension is not available to the CLI SAPI.
What is the fix for this vulnerability?
The issue was fixed in version 0.13.0, and the record links to a commit and a GitHub security advisory describing the patch.
Is this vulnerability known to be exploited in the wild?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.