CVE-2026-10273: Remote Code Execution in php-censor Webhook Handler

Technical summary

The vulnerability exists in src/Model/Build/GitBuild.php within php-censor's webhook endpoint handler. Insufficient input validation on the commitId argument allows an attacker to break out of intended command execution contexts and inject malicious OS commands. The flaw combines aspects of both command injection (CWE-77) and OS command injection (CWE-78), enabling direct shell access with the privileges of the php-censor process. The CVSS v3.1 score of 7.3 reflects high attack complexity scoring due to network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N), with potential impact to confidentiality, integrity, and availability.

Business impact

Successful exploitation grants an attacker the ability to execute arbitrary commands on the server, potentially leading to complete system compromise. Risk scenarios include lateral movement within your CI/CD infrastructure, data theft from build logs or connected repositories, deployment of malicious code into production pipelines, and disruption of your continuous integration workflow. Organizations using php-censor as part of their build automation are particularly exposed because attackers can leverage webhook traffic—often from trusted external sources like version control platforms—to bypass initial perimeter controls.

Affected systems

Any organization running php-censor version 2.1.6 or earlier with an exposed webhook endpoint is vulnerable. The webhook handler is typically accessible to external callers (e.g., GitHub, GitLab, Gitea webhook services) to trigger builds on code push events. Verify your php-censor deployment version and confirm whether your webhook endpoints are accessible from the internet or from untrusted networks.

Exploitability

Exploitability is moderate to high. The vulnerability requires no authentication and can be triggered by any actor with network access to the webhook endpoint—including legitimate webhook sources if an attacker can intercept or spoof webhook requests. Public disclosure of the exploit technique increases the risk of automated scanning and weaponized attack tools. However, successful exploitation does depend on the attacker understanding the expected webhook payload structure and crafting a malicious commitId value that achieves command injection in the Git command execution context.

Remediation

Apply the patch identified by commit hash cd68d102601320bd319d590b75f7652e66f0685f to your php-censor installation. This patch should address the input validation flaw in GitBuild.php. Verify the patch version against the official php-censor release notes and repository to ensure you are applying the correct update. As an interim measure, restrict network access to webhook endpoints to only known, trusted webhook sources (e.g., static IP ranges of your version control platform) using firewall rules or web application firewall policies.

Patch guidance

Upgrade php-censor to the version containing commit cd68d102601320bd319d590b75f7652e66f0685f. Consult the official php-censor repository and release notes to determine the next available release version after 2.1.6 that includes this patch. Test the patched version in a non-production environment first to ensure compatibility with your existing build configurations and plugins. After patching, restart all php-censor services and verify that webhook functionality remains operational by triggering a test build from your version control platform.

Detection guidance

Monitor php-censor webhook logs and web server access logs for requests containing suspicious characters or command injection patterns in the commitId parameter (e.g., backticks, dollar signs, pipes, semicolons, or command substitution syntax). Implement intrusion detection signatures that flag attempts to inject OS commands via webhook payloads. Monitor process execution logs on the php-censor server for unexpected shell or command-line processes spawned by the php-censor user account. Network-based detection can also identify anomalous webhook requests from unexpected sources or containing payloads that deviate from normal Git webhook structures.

Why prioritize this

This vulnerability merits prompt attention due to the combination of remote exploitability without authentication, public availability of exploitation techniques, direct impact on code delivery infrastructure, and the potential for supply chain compromise. Attackers can inject malicious code into builds, affecting all downstream consumers of your artifacts. Organizations should prioritize patching this vulnerability within their normal critical patch cycle.

Risk score, explained

The CVSS 7.3 HIGH rating reflects the serious but not critical nature of the flaw. The network attack vector (AV:N) and absence of authentication requirements (PR:N, UI:N) drive severity upward. The impact scope is unchanged (S:U), limiting the score below CRITICAL. However, the low attack complexity (AC:L) and confirmed public exploitability push the practical risk higher than the numeric score alone suggests. Organizations should apply additional risk context: internal exposure of the webhook endpoint lowers practical risk; internet-facing endpoints significantly raise it.

Frequently asked questions