CVE-2026-44262

9.4 Critique

Publiée le 13/05/2026 à 00:16 · Modifiée le 17/06/2026 à 12:50 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.

Traduire en français

Produits concernés

dedoc scramble

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.4 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-94

Références

https://github.com/dedoc/scramble/releases/tag/v0.13.22
https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories