PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Medium · fetched 2026-10-30

### Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance `/tmp/phpunit-phpt` on Linux, and executes it from there. PHPUnit uses this directory even when it was created by another user.

Remediation

Upgrade phpunit/phpunit to 13.4.4 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T20:20:13-04:00 · https://github.com/advisories/GHSA-9vw2-f4vp-x7gf

← All threats