CVE-2026-25129: Psysh Privilege Escalation Vulnerability

CVE-2026-25129 Overview

CVE-2026-25129 affects PsySH, a runtime developer console, interactive debugger, and Read-Eval-Print Loop (REPL) for PHP. PsySH automatically loads and executes a .psysh.php file from the Current Working Directory (CWD) on startup. An attacker who controls a directory used as the CWD by a privileged user can place a malicious .psysh.php file there to achieve arbitrary code execution. The flaw is classified as [CWE-427: Uncontrolled Search Path Element]. Downstream tools that embed PsySH, including Laravel Tinker (php artisan tinker), inherit this risk. Versions 0.11.23 and 0.12.19 address the vulnerability.

Critical Impact
When a privileged user (e.g., root, CI runner, or ops account) launches PsySH from an attacker-writable directory, the malicious .psysh.php executes in the victim's context, resulting in local privilege escalation.

Affected Products

PsySH versions prior to 0.11.23 (0.11.x branch)
PsySH versions prior to 0.12.19 (0.12.x branch)
Downstream consumers embedding PsySH, including Laravel Tinker (php artisan tinker)

Discovery Timeline

2026-01-30 - CVE-2026-25129 published to the National Vulnerability Database (NVD)
2026-02-27 - Last updated in NVD database

Technical Details for CVE-2026-25129

Vulnerability Analysis

The vulnerability is a CWD configuration poisoning issue. On startup, PsySH searches the Current Working Directory for a .psysh.php configuration file and executes its contents within the PHP process. PsySH treats the CWD as a trusted source of configuration. This assumption breaks down when the CWD is writable by users other than the one launching PsySH. The result is arbitrary PHP code execution under the launching user's identity.

The impact escalates when the launching user holds elevated privileges. Root accounts, continuous integration runners, and shared operations accounts that start PsySH or Laravel Tinker from /tmp, shared project directories, or other world-writable paths are exposed. Attackers gain command execution with the victim's permissions without needing network access or authentication beyond local file write capability.

Root Cause

The root cause is implicit trust placed in the CWD search path for configuration loading. PsySH loads .psysh.php from the CWD without verifying ownership, permissions, or path integrity. This pattern matches [CWE-427] (Uncontrolled Search Path Element), where a program loads resources from a location that an attacker can influence.

Attack Vector

Exploitation requires the attacker to write a crafted .psysh.php file into a directory that a privileged user later uses as their CWD when launching PsySH or Laravel Tinker. Common scenarios include shared directories such as /tmp, project directories with permissive permissions, or CI workspaces. The attacker waits for the victim to invoke psysh or php artisan tinker from that directory. PsySH then executes the attacker-supplied PHP code with the victim's privileges. No user interaction beyond launching PsySH is needed once the malicious file is in place. Refer to the GitHub Security Advisory GHSA-4486-gxhx-5mg7 for additional technical details.

Detection Methods for CVE-2026-25129

Indicators of Compromise

Presence of .psysh.php files in world-writable directories such as /tmp, /var/tmp, or shared project paths
.psysh.php files owned by unprivileged users in locations where privileged accounts run PsySH or Laravel Tinker
PHP child processes spawning shells, network connections, or privileged commands shortly after psysh or php artisan tinker invocation

Detection Strategies

Audit filesystems for .psysh.php files outside expected user home or project configuration directories
Correlate process telemetry that links psysh or artisan tinker execution to subsequent suspicious child processes
Inspect command history and shell logs for invocations of PsySH or Tinker from non-standard working directories

Monitoring Recommendations

Monitor file creation events for .psysh.php across all writable directories, especially those reachable by non-privileged users
Alert on PsySH or Tinker execution by privileged accounts (root, CI service accounts) from directories not owned by that user
Track installed PsySH versions across development and production hosts to identify systems below 0.11.23 or 0.12.19

How to Mitigate CVE-2026-25129

Immediate Actions Required

Upgrade PsySH to version 0.11.23 or 0.12.19 or later across all systems
Update Laravel and other downstream projects that bundle PsySH to releases incorporating the patched versions
Audit hosts for stray .psysh.php files in world-writable or attacker-reachable directories and remove unauthorized instances
Restrict privileged accounts from launching PsySH or php artisan tinker from untrusted working directories

Patch Information

The maintainers released fixed builds in PsySH v0.11.23 and PsySH v0.12.19. Both releases address the automatic .psysh.php loading behavior. Consult the GitHub Security Advisory GHSA-4486-gxhx-5mg7 for full remediation guidance.

Workarounds

Always cd into a trusted, user-owned directory before invoking psysh or php artisan tinker
Set restrictive permissions on shared directories so non-privileged users cannot create .psysh.php files where privileged users operate
Wrap PsySH and Tinker invocations in shell aliases or scripts that change to a safe directory before launch

bash

# Configuration example: safe wrapper that forces a trusted CWD before launching PsySH
alias psysh='cd "$HOME" && /usr/local/bin/psysh'
alias tinker='cd "$HOME" && php artisan tinker'