Description
An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xdebug | Xdebug | ≤ 2.5.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xdebug | No fix yet | — |
| Debian 13 | xdebug | No fix yet | — |
| Debian 12 | xdebug | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xdebug | No fix yet | — |
| Ubuntu 26.04 LTS | xdebug | No fix yet | — |
| Ubuntu 25.10 | xdebug | No fix yet | — |
| Ubuntu 24.04 LTS | xdebug | No fix yet | — |
| Ubuntu 22.04 LTS | xdebug | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xdebug | No fix yet | — |
| Ubuntu 18.04 LTS | xdebug | No fix yet | — |
| Ubuntu 16.04 LTS | xdebug | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
xdebug Unauthenticated OS Command Execution
exploit/unix/http/xdebug_unauth_exec
GitHub 2 repositories
-
D3Ext/CVE-2015-10141 ★ 31 · Jul 4, 2022
POC exploit for CVE-2015-10141
-
n0m4d22/PoC-CVE-2015-10141-Xdebug ★ 0 · Aug 17, 2025
Proof-of-Concept exploit script for Xdebug 2.5.5 and earlier versions (CVE-2015-10141).
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Xdebug <= 2.5.5 - Command Injection http/cves/2015/CVE-2015-10141.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://xdebug.org/ product
- https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/ technical-description
- http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/ technical-description
- https://www.exploit-db.com/exploits/44568 exploit
- https://www.fortiguard.com/encyclopedia/ips/46000 third-party-advisory
- https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution third-party-advisory