CVE-2026-22034
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.73%
- CWE
- CWE-636
- Published
- 2026-01-08
- Last modified
- 2026-03-12
Affected products
- jvoisin snuffleupagus
Weakness type
Related vulnerabilities
- CVE-2026-81379 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-86120 — APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
- CVE-2026-18329 — NGINX ngx_http_js_module vulnerability
- CVE-2026-82744 — Ash.Reactor change step fails open, skipping a change when its where guard raises
- CVE-2026-82018 — IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
- CVE-2026-46482 — MyBB: Security Question insufficient validation
- CVE-2026-73421 — NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)