junaire / CVE-2026-109618-exploit

# CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress exploit
Unauthenticated RCE in PHP core's `session.upload_progress` handling
(CVSS v4.0 9.2, both CVEs). Fixes shipped 2026-10-21 (8.2.35 / 8.3.36 /
8.4.27 / 8.5.12); every earlier PHP with `session.upload_progress` — 5.4.0
through 8.5.11 — is affected. Mitigation: `session.upload_progress.enabled = Off`.
This project contains a working exploit (`exploit.py`) and a Docker target environment that
reproduces the vulnerable host profile (nginx + php-fpm 8.2.34, per-directory
`session.serialize_handler`).
## The chain (two unauthenticated requests)
 [code] 
The exploit injects `O: :1:{ :" "}` — any loaded class whose
`__destruct` executes or calls into something with the property you control.
Default gadget: `Logger->cmd` (defined by the target's `api/app.php`, standing in
for real app/preload classes). Payload: ~48 bytes.
## Layout
 [code] 
## Usage
 [code] 
Verified transcript against this environment (PHP 8.2.34-fpm):
 [code] 
The command output appears in the trigger response: `__destruct` (and thus
`system()`) runs during `session_start()`'s decode-failure cleanup, before the
script body — followed by the expected
`Failed to decode session object. Session has been destroyed` warning.
## What a real target needs
| Condition | Why |
|---|---|
| `session.upload_progress.enabled=On` (default) | the injection channel |
| `session.upload_progress.cleanup=Off` | keeps the seeded payload on disk (with the default `On` only a race window remains) |
| two reachable dirs with different `session.serialize_handler` (`.user.ini` / `.htaccess`) | write side php_serialize, read side php — the `|` split |
| a class with a useful `__destruct` loaded when `session_start()` runs (app code, `opcache.preload`, `auto_prepend_file`) | the RCE gadget; `--gadget/--prop` to match it |
| `session.use_strict_mode=0` (default) | attacker-chosen session id via the POST `PHPSESSID` field (bypasses `use_only_cookies`) |
Note: the payload must ride the **`PHP_SESSION_UPLOAD_PROGRESS` field value**,
not the uploaded filename — multipart part-header lines are capped at ~5 KB and
truncate larger payloads.
## Disclaimer
For authorized security testing and research only. Run it against your own test
environments or systems you have explicit permission to test.