CVE-2026-44262: Scramble Laravel RCE Vulnerability

CVE-2026-44262 Overview

CVE-2026-44262 is a code injection vulnerability in Scramble, a package that generates API documentation for Laravel projects. Affected versions span from 0.13.2 to releases prior to 0.13.22. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request-supplied data is evaluated during documentation generation. This evaluation results in arbitrary PHP code execution within the application context. The issue is tracked as [CWE-94] Improper Control of Generation of Code and is fixed in version 0.13.22.

Critical Impact

Unauthenticated attackers can execute arbitrary PHP code in the Laravel application context by sending crafted input to publicly exposed Scramble documentation endpoints.

Affected Products

• Scramble 0.13.2 through 0.13.21
• Laravel applications exposing Scramble documentation endpoints publicly
• Deployments using validation rules that reference user-controlled input

Discovery Timeline

• 2026-05-12 - CVE-2026-44262 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44262

Vulnerability Analysis

Scramble inspects Laravel controllers and validation rules at runtime to generate OpenAPI documentation. During this analysis, the package evaluates expressions tied to validation rules. When those rules contain references to user-controlled request data, the evaluation path processes attacker-supplied input as executable PHP rather than treating it as inert data.

The outcome is arbitrary PHP code execution under the application's process identity. An attacker gains the same file system, database, and network privileges held by the Laravel runtime. Confidentiality and integrity exposure is high because attackers can read secrets, modify application data, and pivot to internal services reachable from the host.

Root Cause

The root cause is unsafe evaluation of validation rule context during documentation generation. Scramble does not enforce a boundary between static rule definitions and dynamic, request-derived values. Once a rule references request input, the documentation generator processes that input through a code evaluation path. This pattern maps directly to [CWE-94] Improper Control of Generation of Code.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to a publicly reachable Scramble documentation route. The request payload contains values that the documentation generator dereferences and evaluates. No prior access to the application is required when the documentation endpoint is exposed without authentication. Refer to the GitHub Security Advisory GHSA-4rm2-28vj-fj39 for the maintainer's technical analysis.

Detection Methods for CVE-2026-44262

Indicators of Compromise

• Unexpected outbound network connections originating from the PHP-FPM or web server process.
• New or modified PHP files in the Laravel application directory, particularly under storage/, bootstrap/cache/, or writable upload paths.
• Web server access logs showing requests to Scramble documentation routes such as /docs/api containing unusual query parameters or POST bodies.
• Process activity spawning shell interpreters (sh, bash) as child processes of the web server.

Detection Strategies

• Inventory Laravel deployments and identify any using Scramble between 0.13.2 and 0.13.21.
• Audit route definitions to determine whether Scramble documentation endpoints are exposed to untrusted networks.
• Review validation rule definitions for references to request data that flow into the documentation generator.
• Correlate web request logs with process execution telemetry to detect anomalous child processes from the PHP runtime.

Monitoring Recommendations

• Alert on creation of executable files within Laravel application directories by the web server user.
• Monitor for HTTP requests to documentation endpoints from external sources and rate-limit access.
• Log and review all 5xx errors from documentation routes, which often indicate exploitation attempts.

How to Mitigate CVE-2026-44262

Immediate Actions Required

• Upgrade Scramble to version 0.13.22 or later using composer update dedoc/scramble.
• Restrict documentation routes to authenticated administrators or internal networks until patching is complete.
• Review recent web server and application logs for suspicious requests targeting Scramble routes.
• Rotate application secrets, API keys, and database credentials if exploitation is suspected.

Patch Information

The maintainers released the fix in Scramble v0.13.22. Upgrade with Composer and verify the installed version with composer show dedoc/scramble. Details on the fix are documented in GitHub Security Advisory GHSA-4rm2-28vj-fj39.

Workarounds

• Disable Scramble documentation routes in production until the upgrade is applied.
• Apply authentication middleware to Scramble routes to prevent unauthenticated access.
• Remove validation rules that reference user-controlled request data from controllers analyzed by Scramble.

# Configuration example: restrict Scramble routes with middleware in config/scramble.php
# Apply auth middleware so documentation endpoints require authentication
return [
    'api_path' => 'api',
    'middleware' => [
        'web',
        'auth',
    ],
];

# Then upgrade the package
composer require dedoc/scramble:^0.13.22
composer show dedoc/scramble