Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpunit | 5.4.6-2 | — |
| Debian 13 | phpunit | 5.4.6-2 | — |
| Debian 12 | phpunit | 5.4.6-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | phpunit | 5.1.3-1+ubuntu3+esm1 | USN-7171-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) EDB-50702 · webapps · Feb 2, 2022
GitHub 18 repositories · most starred shown
-
RandomRobbieBF/phpunit-brute ★ 28 · May 18, 2020
Tool to try multiple paths for PHPunit RCE CVE-2017-9841
-
incogbyte/laravel-phpunit-rce-masscaner ★ 23 · Jul 4, 2021
Masscanner for Laravel phpunit RCE CVE-2017-9841
-
Chocapikk/CVE-2017-9841 ★ 7 · Aug 27, 2023
PHPUnit RCE
-
ludy-dev/PHPUnit_eval-stdin_RCE ★ 6 · Sep 14, 2020
(CVE-2017-9841) PHPUnit_eval-stdin_php Remote Code Execution
-
drcrypterdotru/PHPUnit-GoScan ★ 5 · Aug 30, 2025
PHPUnit CVE-2017-9841 Scanner in Go clean and fire.
-
MadExploits/PHPunit-Exploit ★ 5 · Dec 7, 2022
PHPunit Checker CVE-2017-9841 By MrMad
-
MrG3P5/CVE-2017-9841 ★ 4 · Mar 13, 2023
A Tool for scanning CVE-2017-9841 with multithread
-
p1ckzi/CVE-2017-9841 ★ 3 · Apr 9, 2022
phpunit-shell | CVE_2017-9841
-
akr3ch/CVE-2017-9841 ★ 3 · Mar 20, 2022
RCE exploit for PHP Unit 5.6.2
-
dream434/CVE-2017-9841 ★ 1 · Nov 21, 2022
CVE-2017-9841
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- PHPUnit - Remote Code Execution http/cves/2017/CVE-2017-9841.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpunit/phpunit | >= 4.8.19, < 4.8.28 | 4.8.28 | GHSA-r7c9-c69m-rph8 |
| Packagist | phpunit/phpunit | >= 5.0.10, < 5.6.3 | 5.6.3 | GHSA-r7c9-c69m-rph8 |
Advisories 1
- USN-7171-1 phpunit vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
References
- 101798 vdb-entry
- 1039812 vdb-entry
- GLSA-201711-15 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
- https://github.com/sebastianbergmann/phpunit/pull/1956
- http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/