PKSA-qhjm-rpqc-qkn6: Composer/phpunit/phpunit vulnerability

Q: Who is realistically exposed to exploitation?

Systems where untrusted or less-trusted users have local access and share the temporary directory used during PHPUnit PHPT code coverage handling are exposed.

Q: What access does an attacker need?

The attacker needs local access as another user and the ability to interact with the shared temporary-directory environment involved in PHPT code coverage handling.

Published Oct 27, 2026

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Affected Software

1 affected componentFixes available

composer/phpunit/phpunit>=13.4.0, <13.4.4

13.4.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/phpunit/phpunit to a version that resolves this vulnerability.
Fixed in 13.4.4

Frequently Asked Questions

Who is realistically exposed to exploitation?

Systems where untrusted or less-trusted users have local access and share the temporary directory used during PHPUnit PHPT code coverage handling are exposed.

What access does an attacker need?

The attacker needs local access as another user and the ability to interact with the shared temporary-directory environment involved in PHPT code coverage handling.

PKSA-qhjm-rpqc-qkn6: Composer/phpunit/phpunit vulnerability

Affected Software

Remediation

Frequently Asked Questions

Who is realistically exposed to exploitation?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

What access does an attacker need?