CVE-2017-9841VulnerabilityPublished 02/15/2022Updated 10/24/2026

CVE-2017-9841: PHPUnit Command Injection Vulnerability

Affects PHPUnit PHPUnitSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 02/15/2022
KEV deadline: 08/15/2022
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-9841 (opens in a new tab)

Description

CVE-2017-9841 is a command injection vulnerability in PHPUnit that allows remote attackers to execute arbitrary PHP code via HTTP POST data starting with a "<?php " substring. This occurs when a site exposes the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI, enabling external access to this evaluation script. The vulnerability has been exploited in the wild.

Summary

PHPUnit contains a command injection vulnerability (CVE-2017-9841) that permits remote code execution through specially crafted HTTP POST requests containing PHP code. The attack targets installations where the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php script is accessible externally, such as when the /vendor directory is exposed on a web server. This script evaluates PHP code passed via POST data, allowing attackers to run arbitrary PHP commands on the server.

Impact

Successful exploitation allows remote attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise. This can result in unauthorized access, data theft, service disruption, or further attacks within the network. The vulnerability has been observed in active exploitation campaigns.

Mitigation

No explicit patch or remediation details are provided in the input data. Users should ensure that the /vendor directory, especially the eval-stdin.php script, is not publicly accessible on production servers. Removing or restricting access to PHPUnit components in production environments is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:11:36 UTC

Weaknesses

References

Related threats