CVE-2026-46420 Details
Description
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.
A command injection vulnerability exists in the GitHub Action 'setup-php' by shivammathur, specifically in versions 2.25.0 prior to 2.37.1. The vulnerability arises when the action resolves the PHP version from repository-controlled files, such as '.php-version', 'composer.lock' via 'platform-overrides.php', and 'composer.json' via 'config.platform.php'. In affected versions, these values were not properly validated before being included in the generated setup scripts for shell or PowerShell, allowing for command injection on the GitHub Actions runner. This issue is particularly concerning in workflows that use 'pull_request_target' and check out untrusted code before running 'setup-php'.
Users should upgrade to 'shivammathur/setup-php' version 2.37.1 or later, which includes a fix for the vulnerability by validating PHP version inputs, constraining manifest-derived versions, and hardening script generation for execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shivammathur setup php | >= 2.25.0, < 2.37.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |