p PatchFirst

CVE-2026-44262

CVE-2026-44262 · Scramble: Remote code execution via evaluation of user-controlled input in validation rules

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.

CVSS 9.4 · Critical · EPSS 5.9% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • scramble

    Versions
    • >= 0.13.2, < 0.13.22: Affected

    No fix published

  • dedoc/scramble Packagist

    Versions
    • v0.13.10
    • v0.13.11
    • v0.13.12
    • v0.13.13
    • v0.13.14
    • v0.13.15
    • v0.13.16
    • v0.13.17
    • v0.13.18
    • v0.13.19
    • v0.13.2
    • v0.13.20
    • v0.13.21
    • v0.13.3
    • v0.13.4
    • v0.13.5
    • v0.13.6
    • v0.13.7
    • v0.13.8
    • v0.13.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.13.2, < 0.13.22

    Update to 0.13.22

Original sources

Check your server →