Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-24765 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Phpunit Project Phpunit. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24765 is a deserialization vulnerability in PHPUnit, a testing framework for PHP, affecting versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52. The issue resides in the `cleanupForCoverage()` method, which deserializes code coverage files (`.coverage`) without validation, such as the `allowed_classes` parameter restriction, during PHPT test execution. This unsafe deserialization occurs if a `.coverage` file exists unexpectedly before test execution, potentially leading to remote code execution when code coverage instrumentation is enabled.
An attacker requires local file write access to the directory where PHPUnit stores or expects code coverage files for PHPT tests. They can place a malicious serialized object with a `__wakeup()` method into a `.coverage` file, triggering arbitrary code execution upon deserialization during test runs. Exploitation is feasible in scenarios like CI/CD pipeline attacks, local development environments, or through compromised dependencies, with a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and associated CWE-502.
Patches in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 detect pre-existing `.coverage` files for PHPT tests prior to execution and emit a clear error message instead of silently sanitizing input. Organizations can mitigate risk by updating to these versions and implementing CI/CD best practices, such as ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Relevant details are available in the fix commit and release notes on GitHub.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4725
Vulnerability Data
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method,…
more
which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can uncover deserialization flaws before deployment.
Input validation directly stops deserialization of untrusted data by ensuring inputs are valid before processing.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
Requiring vetted libraries, regular updates and SAST before release reduces the likelihood that deserialization logic will accept and act on attacker-controlled serialized objects.
Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.