Description
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dedoc | scramble | >= 0.13.2, < 0.13.22 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- scramble - Remote Code Execution EDB-52582 · webapps · May 27, 2026
GitHub 2 repositories
-
joshuavanderpoll/CVE-2026-44262 ★ 3 · May 7, 2026
Unauthenticated RCE in dedoc/scramble — PoC, Nmap NSE & Nuclei template.
-
akash-osmsec/CVE-2026-44262- ★ 0 · Jul 18, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Scramble Laravel - Remote Code Execution http/cves/2026/CVE-2026-44262.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | dedoc/scramble | >= 0.13.2, < 0.13.22 | 0.13.22 | GHSA-4rm2-28vj-fj39 |