Skip to content
OpenAdvisories

Package · GitHub Actions

shivammathur/setup-php

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.6
    CVE-2026-46420 Public exploit

    setup-php: Command Injection in Repository-Derived PHP Version Resolution

    setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock t…

    shivammathur setup-php shivammathur/setup-php GitHub Actions
  • Medium 5.9
    GHSA-5wxr-w449-57cm

    Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

    ### Impact This affects only workflows that pin an exact affected Composer semver version through setup-php, for example `tools: composer:2.9.7`. Workflows using the default Composer version, `composer:v2`, or no pinned Composer version are not affected throu…

    shivammathur/setup-php GitHub Actions