[php-src] Issue #24816: [SECURITY] BUG-089: Injection - Command Injection via system()/exec()/passthru()/proc_open()
| From: | Codeleafly | Date: | Wed, 28 Oct 2026 01:48:55 +0000 |
| Subject: | [php-src] Issue #24816: [SECURITY] BUG-089: Injection - Command Injection via system()/exec()/passthru()/proc_open() | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253270@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24816
Author: Codeleafly
## 🐛 Security Bug Report
**Bug ID:** BUG-089
**Category:** Injection
**Subcategory:** Command Injection via system()/exec()/passthru()/proc_open()
**Severity:** Critical
**CWE:** CWE-78
**CVSS Score:** 9.0
**File:**
**Line:** multiple
**Status:** UNFIXED
**Verified:** False
### Description
Command execution functions (system, exec, passthru, proc_open) may pass unsanitized user input to
shell. Shell metacharacters can inject arbitrary commands.
### Impact
Remote code execution with web server privileges.
### Remediation
Use escapeshellarg() and escapeshellcmd() on all user input. Prefer execv() family over system().
### Exploitability
Remote - trivial exploitation
### Source
- Repository: https://github.com/php/php-src/
- Branch: master
- Analysis Date: 2026-10-27T16:38:37.937347Z
---
*Auto-generated from static security analysis of php-src.*