CyberRota Analysis
AI-GeneratedThe setup-php GitHub action, versions 2.25.0 to 2.37.1, is vulnerable to command injection due to insufficient validation of PHP version inputs from repository-controlled files. This flaw can be exploited when workflows, such as pull_request_target, process attacker-controlled content, potentially allowing malicious commands to execute on the GitHub Actions runner. Organizations using this action should prioritize upgrading to version 2.37.1 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.