CVE-2026-10273: PHP-Censor RCE Vulnerability

CVE-2026-10273 Overview

CVE-2026-10273 is an operating system command injection vulnerability in php-censor versions up to 2.1.6. The flaw resides in the src/Model/Build/GitBuild.php file within the Webhook Endpoint component. Attackers can manipulate the commitId argument to inject arbitrary shell commands into git operations executed by the build server. The vulnerability is exploitable remotely without authentication, and a public exploit is available. The maintainers released a fix in commit cd68d102601320bd319d590b75f7652e66f0685f, which applies escapeshellarg() to the user-controlled parameter.

Critical Impact
Remote, unauthenticated attackers can execute arbitrary OS commands on php-censor build servers by sending crafted webhook payloads containing malicious commitId values.

Affected Products

php-censor up to and including version 2.1.6
Component: Webhook Endpoint (src/Model/Build/GitBuild.php)
Weakness category: [CWE-77] Improper Neutralization of Special Elements used in a Command

Discovery Timeline

2026-06-01 - CVE-2026-10273 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10273

Vulnerability Analysis

php-censor is a self-hosted continuous integration server for PHP projects. The GitBuild model accepts a commitId parameter from webhook requests and passes it directly into shell commands such as git checkout and git log. The application invoked executeCommand() with the raw commitId value as a substitution argument. Because the value was not escaped, shell metacharacters survived to the command line.

An attacker who can reach the webhook endpoint can submit a crafted payload where commitId contains shell separators. The injected payload executes with the privileges of the php-censor build worker process. This typically yields code execution on the CI server, exposing source code, build secrets, deployment credentials, and pivot opportunities into connected infrastructure.

Root Cause

The root cause is missing input sanitization on the commitId argument before it is concatenated into a shell command string. The patched code wraps the argument with \escapeshellarg($commitId), which neutralizes characters such as ;, &, |, backticks, and $() that would otherwise terminate the intended git invocation and start a new command.

Attack Vector

Exploitation requires sending a webhook request to a reachable php-censor instance with a commitId field containing shell command injection syntax. No authentication or user interaction is required. The injected commands run during the build setup phase when php-censor attempts to check out the specified commit.

php

// Patch applied in src/Model/Build/GitBuild.php
// Source: https://github.com/php-censor/php-censor/commit/cd68d102601320bd319d590b75f7652e66f0685f

        if (empty($this->getEnvironmentId()) && !empty($commitId)) {
            $cmd     = $chdir . ' && git checkout %s --quiet';
-           $success = $builder->executeCommand($cmd, $cloneTo, $commitId);
+           $success = $builder->executeCommand($cmd, $cloneTo, \escapeshellarg($commitId));
        }

        // Always update the commit hash with the actual HEAD hash

The patch wraps $commitId with escapeshellarg() so that arbitrary shell metacharacters are quoted as literal data rather than interpreted as command syntax.

Detection Methods for CVE-2026-10273

Indicators of Compromise

Webhook requests where the commitId field contains shell metacharacters such as ;, |, &&, backticks, or $(...).
Unexpected child processes spawned by the php-censor worker process, including sh, bash, curl, wget, or nc invoked during a git checkout or git log stage.
Outbound network connections from the CI server to unfamiliar hosts during build initialization.
Build logs containing git checkout lines with values that do not conform to a 40-character hexadecimal SHA-1 hash.

Detection Strategies

Inspect php-censor application and webserver logs for POST requests to webhook endpoints with anomalous commitId values.
Monitor process lineage on CI hosts and alert when the php-censor PHP process is the parent of an interactive shell or arbitrary network utility.
Apply [CWE-77] command injection rules to web application firewall (WAF) traffic destined for php-censor endpoints.

Monitoring Recommendations

Forward php-censor logs and CI host process telemetry to a centralized analytics pipeline for correlation against webhook payloads.
Track integrity of files inside the CI workspace and the php-censor installation directory for unauthorized modifications.
Alert on new persistence artifacts such as cron entries, SSH authorized keys, or systemd units created by the php-censor user account.

How to Mitigate CVE-2026-10273

Immediate Actions Required

Upgrade php-censor to a version that includes commit cd68d102601320bd319d590b75f7652e66f0685f from the php-censor GitHub repository.
Restrict network access to the php-censor webhook endpoint so that only trusted source IP ranges, such as your version control system, can reach it.
Rotate any secrets, deployment keys, or API tokens stored on the CI server if exploitation is suspected.

Patch Information

The fix is published in commit cd68d102601320bd319d590b75f7652e66f0685f. The patch escapes the commitId argument in both git checkout and git log invocations using PHP's escapeshellarg(). Refer to the GitHub Commit Details, the originating GitHub Issue, and the corresponding Pull Request.

Workarounds

Place the php-censor webhook behind a reverse proxy or WAF that validates commitId values against a strict regular expression matching git SHA-1 or SHA-256 hashes.
Run the php-censor worker under a dedicated low-privilege user with no sudo rights and constrained filesystem access.
Disable the webhook endpoint entirely until the patched release can be deployed, and trigger builds manually instead.

bash

# Example reverse proxy rule to reject non-hex commitId values before they reach php-censor
# nginx fragment
location /webhook/ {
    if ($arg_commitId !~ "^[a-fA-F0-9]{7,64}$") {
        return 400;
    }
    proxy_pass http://php_censor_backend;
}