Cyber Resilience

CVE-2026-44262

CriticalRCE

Published: 12 May 2026

Published
12 May 2026
Modified
13 May 2026
KEV Added
Patch
CVSS Score v3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0586 92.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-44262 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

Scramble, a package that generates API documentation for Laravel projects, is affected by a code injection vulnerability in versions 0.13.2 through 0.13.21. The flaw occurs when publicly accessible documentation endpoints process validation rules that reference user-controlled input, causing request data to be evaluated during documentation generation and resulting in arbitrary PHP code execution within the application context. The issue is tracked as CWE-94 and carries a CVSS 3.1 score of 9.4.

An unauthenticated remote attacker can exploit the vulnerability simply by submitting crafted requests to the exposed documentation endpoints, achieving code execution that compromises confidentiality and integrity with partial impact on availability.

The vulnerability is resolved in release 0.13.22, according to the project's GitHub advisory GHSA-4rm2-28vj-fj39 and corresponding tagged release. The EPSS score has remained flat at 0.0861 with no material increase observed since disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code…

more

in the application context. This vulnerability is fixed in 0.13.22.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Publicly accessible documentation endpoints allow user-controlled input in validation rules to be evaluated, directly enabling remote arbitrary PHP code execution via exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-41229Shared CWE-94
CVE-2026-40563Shared CWE-94
CVE-2024-32641Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-2052Shared CWE-94
CVE-2026-9170Shared CWE-94
CVE-2025-54451Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2025-22204Shared CWE-94
CVE-2026-8855Shared CWE-94

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces access control on the publicly exposed documentation endpoints so that unauthenticated requests cannot trigger evaluation of user-supplied validation rules.

prevent

Requires validation and sanitization of all input data before it is used in any evaluation or code-generation context, directly blocking the CWE-94 injection path.

prevent

Restricts the application to only the minimum required functionality, disabling or protecting the optional public documentation-generation feature that enables the vulnerability.

References