Vulnerability record · CVE-2017-9841 · published 27 June 2017
CVE-2017-9841: PHPUnit eval-stdin.php remote PHP code execution
Phpunit Project · Phpunit
PHPUnit before 4.8.28 and 5.x before 5.6.3 ships Util/PHP/eval-stdin.php, which evaluates HTTP POST body content as PHP when it begins with a "<?php " substring. If the vendor directory is reachable over the web, an unauthenticated attacker can run arbitrary PHP code on the server.
Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS of 9.8, KEV listing and near-maximum EPSS probability.
What it is
PHPUnit before 4.8.28 and 5.x before 5.6.3 ships Util/PHP/eval-stdin.php, which evaluates HTTP POST body content as PHP when it begins with a "<?php " substring. If the vendor directory is reachable over the web, an unauthenticated attacker can run arbitrary PHP code on the server.
Impact
An attacker gains remote code execution in the web server's PHP context, allowing full compromise of the application and its data.
Attack surface
Reached over the network by POSTing PHP code to the exposed /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI; no authentication or user interaction is required per the CVSS vector.
Exploitation
Listed in CISA KEV since 2022-02-15 and carries an EPSS 30-day probability of 0.99999, indicating active exploitation in the wild.
What to do
- Upgrade PHPUnit to 4.8.28 or 5.6.3 (or later) per the vendor patch commits.
- Remove or block web access to vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and deny direct HTTP access to the vendor directory.
- Apply the referenced Oracle and Gentoo updates where PHPUnit is bundled in those products.
- Scan deployed codebases for exposed vendor directories and remove PHPUnit from production deployments.
Detection
- Search web logs for POST requests to paths containing /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php.
- Inspect POST bodies to that URI for content beginning with "<?php ".
- Alert on unexpected PHP process execution or outbound connections originating from the web server after such requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-9841 to the Known Exploited Vulnerabilities catalog on 15 February 2022 as "PHPUnit Command Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 August 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-9841 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-9841), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
