## Summary Coraza extracts a multipart file upload's filename using Go's standard-library `mime.ParseMediaType`, which only decodes the RFC 5987/6266 extended `filename*` `Content-Disposition` parameter when its declared charset is exactly `us-ascii` or `utf-8`. Any other charset — including `iso-8859-1`, which RFC 5987 explicitly permits — is silently dropped by the stdlib, with no error and no fallback signal. This lets an attacker present one filename to Coraza and a different one to the backend application in the same request. ## Affected variables `FILES` (documented as *"the original filenames as submitted by the client in the multipart upload"*), `FILES_SIZES`, and the file-vs-field routing decision that determines whether a part is tracked as a file at all. `MULTIPART_FILENAME` is not affected. It is declared in Coraza but is not populated by any code path in the affected versions. ## Details `internal/bodyprocessors/multipart.go`'s `originFileName` calls `mime.ParseMediaType` on the raw `Content-Disposition` header and reads `dispositionParams["filename"]`, which then populates `FILES`/`FILES_SIZES` for parts recognized as file uploads. Per RFC 7578 §4.2 and RFC 6266, when both `filename` and `filename*` are present, `filename*` is authoritative. Go's `mime.ParseMediaType` implements this precedence internally (`decode2231Enc` in `mediatype.go`), but only for `filename*` values whose charset token is `us-ascii` or `utf-8`: ```go // mime/mediatype.go if charset != "us-ascii" && charset != "utf-8" { // TODO: unsupported encoding return "", false } ``` When `decode2231Enc` returns `false`, the stdlib silently leaves whatever was parsed for the plain `filename` parameter untouched (or leaves `filename` absent entirely if only `filename*` was supplied) — there is no error, no partial-parse indicator, nothing a caller can detect. The stdlib also discards the RFC 5987 `language` component of `filename*` entirely; it is not recoverable from the parsed params map at all. ### Verified behavior (prior to the fix) | `Content-Disposition` fields | Effective filename (`FILES`) | Recognized as file upload? | |---|---|---| | `filename="safe.jpg"; filename*=UTF-8''shell.php` | `shell.php` (correct) | yes | | `filename="safe.jpg"; filename*=iso-8859-1''shell.php` | `safe.jpg` (decoy wins) | yes, but with the wrong name | | `filename*=iso-8859-1''shell.php` (no plain `filename`) | *(none)* | **no** — processed as an ordinary form field into `ARGS_POST` instead | In the second row, any rule inspecting `FILES` for a dangerous extension only ever sees `safe.jpg`, while a backend that follows RFC 7578 precedence and accepts `iso-8859-1` (an RFC-5987-legal, non-exotic charset) uses `shell.php` as the filename. In the third row, the upload skips file-specific rule scope and size-limit tracking (`FILES_COMBINED_SIZE`) entirely. ## Impact A rule set that blocks file uploads by extension or name via `FILES` (or scopes rules to `FILES`/`FILES_NAMES`) can be bypassed by supplying the real filename via `filename*` under any charset other than `utf-8`/`us-ascii` — `iso-8859-1` is sufficient and is a standards-compliant choice, not an obscure or malformed one — optionally alongside an innocuous decoy `filename`. A part carrying only `filename*` additionally escapes file-vs-field routing, so `FILES`, `FILES_NAMES` and `FILES_COMBINED_SIZE` never see it. The bypass is deterministic against Coraza and requires no authentication or user interaction. Its effect is bounded to filename-derived inspection: request body content, `ARGS` and headers are still inspected, and a part carrying only `filename*` is routed into `ARGS_POST`. Coraza itself neither stores nor serves the uploaded file, so whether an evaded rule was preventing a change of state depends on the backend's own `filename*` precedence handling and upload handling. This is scored as a scope-changing bypass with low integrity impact (`S:C`, `I:L`) rather than a direct compromise. ## Proof of Concept ``` Content-Disposition: form-data; name="upload"; filename="safe.jpg"; filename*=iso-8859-1''shell.php ``` Processed through `internal/bodyprocessors/multipart.go` prior to the fix, `FILES` for this part contained `safe.jpg`. A `SecRule FILES "\.php$"` (or similar extension-blocklist rule) did not fire, while a backend honoring RFC 5987/7578 `filename*` precedence uses `shell.php` as the filename. ## Resolution Fixed by locating and decoding `filename*` independently of `mime.ParseMediaType`'s charset restriction (a quoted-string-aware scanner over the raw header). The fix also populates `MULTIPART_FILENAME`/`MULTIPART_NAME`, which were previously declared but unpopulated. **Both readings are exposed, not just `filename*`.** An earlier version of this fix made `filename*` unconditionally authoritative over the plain `filename`, per RFC 7578 §4.2 — this closed the PoC above but relocated the same bypass: swap which field carries the real name (`filename="shell.php"; filename*=iso-8859-1''safe.jpg`) and a backend that resolves the plain `filename` instead is missed, since the discarded reading never reached `FILES` at all. Fixed in `89399e67`: when a well-formed `filename*` picks a different value than the plain `filename`, both are added to `FILES`/`FILES_SIZES`/`MULTIPART_FILENAME` for the same part (one temp file, one byte count, two names). A `SecRule FILES "\.php$"` now catches the payload regardless of which field carries the real name. Coraza does not select a "safe" charset allowlist on the operator's behalf. Instead, `filename*`'s declared charset and language are exposed as their own rule-matchable collections, `MULTIPART_FILENAME_CHARSET` and `MULTIPART_FILENAME_LANGUAGE`, alongside `MULTIPART_FILENAME`, so operators can enforce their own allowlist. Design credit: **@airween**. For `Content-Disposition: form-data; name="upload"; filename="safe.jpg"; filename*=UTF-8''shell.php`: ``` MULTIPART_FILENAME:upload = [shell.php, safe.jpg] (filename* first, plain filename kept alongside) MULTIPART_FILENAME_CHARSET:upload = UTF-8 MULTIPART_FILENAME_LANGUAGE:upload = "" (empty string; language is optional) ``` Rule writers can enforce a charset allowlist directly. Use an anchored regex rather than `@within`: ``` SecRule MULTIPART_FILENAME_CHARSET:upfile "!@rx ^(?:utf-8|iso-8859-1|us-ascii)$" \ "id:199,phase:2,t:none,t:lowercase,deny" ``` `!@within utf-8,iso-8859-1,us-ascii` looks equivalent and is not. `@within` treats its parameter as the haystack and the variable as the needle, so an empty value is trivially contained in it and the negation never fires. A `filename*` that declares no charset at all — `filename*=''shell.php`, which RFC 5987's grammar does not permit but which Coraza accepts and exposes rather than rejecting — therefore passes an `@within` allowlist untouched. Measured: | `MULTIPART_FILENAME_CHARSET` | `!@within utf-8,...` | `!@rx ^(?:utf-8\|...)$` | |---|---|---| | `UTF-8` | quiet | quiet | | `shift_jis` | fires | fires | | *(empty, from* `filename*=''...`*)* | **quiet** | fires | Both spellings stay quiet on a part with no `filename*` at all, because the collections are then absent rather than empty and the rule never evaluates. That is what makes an allowlist rule safe to apply to all traffic rather than only to known upload fields. ### Discrepancies are no longer dropped silently The same silent-fallback pattern this advisory describes existed on two neighbouring paths: a part whose `Content-Disposition` was present but unparseable, and a part carrying a `filename*` that did not match the `charset'[language]'value` shape at all. Both were reduced to a part with no filename — routed into `ARGS_POST`, outside `FILES`-scoped rule coverage, with nothing to signal that a filename had been discarded. Both now raise `MULTIPART_STRICT_ERROR` (rule 200003 in CRS). A part with *no* `Content-Disposition` at all is not flagged: it simply carries no filename. `mime.ParseMediaType` accepts every real-world filename shape tested — raw UTF-8 and emoji, spaces, Windows backslashes, a bare `%`, unquoted values — so this signal does not reach legitimate uploads. ### New variable: `MULTIPART_DUPLICATE_PART_HEADER` Set to `1` when a part repeats a header (two `Content-Disposition` headers) or repeats a parameter inside its `Content-Disposition` (two `filename` parameters). A duplicate is precisely where backends disagree about which value wins, so the duplicate itself is the signal; it also contributes to `MULTIPART_STRICT_ERROR`. ``` SecRule MULTIPART_STRICT_ERROR "@eq 1" "id:201,phase:2,deny,t:none,chain" SecRule MULTIPART_DUPLICATE_PART_HEADER "@eq 1" ``` ModSecurity adds the same variable in its fix for [GHSA-5pww-8rfg-9crf](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf) and lists it in the recommended audit-log format as `DH`. Coraza implements it under the same name so that a rule set referencing it parses on both engines. ### Note on percent-decoding Coraza percent-decodes the `filename*` value, so `MULTIPART_FILENAME` and `FILES` hold the name the application will actually resolve. This matters for rules that match on file extension: CRS 933110 and 944140 target `FILES` with `t:none,t:lowercase,t:removeWhitespace` and perform no URL decoding, so an encoded separator such as `filename*=UTF-8''shell%2Ephp` would evade them if the raw value were stored instead. ModSecurity's fix stored the raw, still-encoded value when this was first written; after the difference was raised on its advisory it now percent-decodes as well, so the two engines agree on this point. ### Three further discrepancies found in post-fix review Reviewing the fix (`23446b5e`) against test coverage turned up three more cases where Coraza's parsed value could disagree with what a backend resolves, closed in `f30df398`: - An unresolvable `%` escape in `filename*` (`filename*=UTF-8''safe.jpg%ZZ`) is still kept as-is rather than substituting a decoy plain `filename`, but now also raises `MULTIPART_STRICT_ERROR`. Without this, the discrepancy was silent whenever a backend decoded the same escape differently or rejected it outright. - A quoted `filename*` value (`filename*="UTF-8''shell.php"`) is unwrapped before parsing. RFC 5987 does not permit `filename*` to be a quoted-string, but a general Content-Disposition parser such as Go's `mime.ParseMediaType` accepts a quoted value for any parameter. Without unwrapping, the literal quote characters ended up in `MULTIPART_FILENAME`/`MULTIPART_FILENAME_CHARSET`, so an anchored rule (e.g. `\.php$`) did not match a filename the backend resolved cleanly. - `MULTIPART_FILENAME`, `MULTIPART_FILENAME_CHARSET`, `MULTIPART_FILENAME_LANGUAGE` and `MULTIPART_NAME` are multi-valued collections: two parts sharing one `name` (e.g. a multi-file upload field) each keep their own filename instead of the later part overwriting the earlier one. ModSecurity's fix for [GHSA-5pww-8rfg-9crf](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf) independently identifies and fixes the same class of bug, describing it as "a second, distinct bypass," by keeping the equivalent variables multi-valued. ### The precedence decision itself was found to relocate the bypass Reviewing `filename*`-as-authoritative, @jptosso demonstrated (with a repro against Go's own `mime/multipart` as the reference backend) that this precedence choice doesn't close the two-sided decoy: it only decides which of the two payload shapes above is caught, not both. Checked against ModSecurity v3's actual fix for GHSA-5pww-8rfg-9crf: it makes the identical unconditional-precedence choice (single value, `filename*` wins, plain `filename` discarded), with no record of the two-sided case being considered there either — this is not a case of Coraza deviating from a more careful upstream fix. Fixed in `89399e67` by keeping both readings rather than picking one (see Resolution above). Test coverage for the original PoC direction only ever exercised the `filename="safe.jpg"; filename*=...''shell.php` order; the swapped order (`filename="shell.php"; filename*=...''safe.jpg`) is now a dedicated regression case, since that gap in coverage is exactly why the one-sided version shipped in the first place. ### Patched in 3.8.1 The 3.8.0 fix was incomplete. 3.8.1 completes it: an RFC 2231 numbered continuation (`filename*0=`, `filename*0*=`, ...) next to a bare `filename*` parameter now sets `MULTIPART_STRICT_ERROR`, and the Content-Disposition duplicate-parameter check added in 3.8.0 is now linear instead of quadratic in the number of parameters. Upgrade to 3.8.1; 3.8.0 is listed as affected. ### Severity (revised 2026-10-02) `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N` (4.0, Medium). Attack Complexity is High because the bypass depends on a specific backend behaviour outside the attacker's control. Go's `mime.ParseMediaType` and PHP resolve the same filename Coraza did, so they are not affected. The discrepancy exists only for backends that decode a non-UTF-8 `filename*` or treat a `filename*`-only part as a file, such as Werkzeug/Flask and busboy-based Node.js backends (Express with multer, Fastify). The continuation case fixed in 3.8.1 is resolved only by Werkzeug. The previous vector scored Attack Complexity Low (5.8). Impact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately. _AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, "CVSS preconditions get verified, not copied from the report") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._
PoC: node2shell-scanner
High fidelity detection mechanism for node2shell (CVE-2026-111497)
PoC: http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
PoC: runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu servers.
PoC: php2shell-scan
A deliberately limited, read-only security scanner for assessing exposure to CVE-2026-109618 (RFC 1867 multipart OOM memory corruption) and CVE-2026-109619 (stale global state use-after-free) in PHP deployments.
PoC: CVE-2026-98260-OnePlus16-PYB110-Jailbreak
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
PoC: php2shell-wordpress-rce-fullchain
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
PoC: php2shell-scanner
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
PoC: php2shell-wordpress-check
A read-only Site Health check that compares the PHP version your site is running with the releases that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.
PoC: AI-Threat-Detection-PHP-CGI-Vulnerabilities
A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.
PoC: php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
PoC: node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
PoC: php2shell-ioc
Curated IoCs, detection engineering rules, and automated threat intel feeds for PHP2Shell (CVE-2026-109618 & CVE-2026-109619).
PoC: php2shell-toolkit
CVE-2026-109618 PHP session.upload_progress detection & authorized testing toolkit
PoC: HTTP2Shell-PoC
PoC for CVE-2026-111497 (HTTP2Shell)
PoC: cve-2024-10441-synology-rce
Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.
PoC: php2shell-migration
Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outdated PHP. Works with Claude Code, Codex, Copilot, Cursor, Gemini CLI, OpenCode.
PoC: php2shell
CVE-2026-109618 exploit tool — RCE via OOM ghost bucket in PHP POST parsing (CVSS 9.2)
PoC: php82-ubuntu2404-backport
PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ubuntu1
PoC: CVE-2026-109618-109619-php2shell
CVE-2026-109618-109619 PHP2shell
PoC: php2shellscanner-web
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
PoC: php2shell-research-public
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
PoC: PHP2shell
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
PoC: B63-POC-CVE-2026-20131
CVE-2026-20131 (Cisco FMC): pre-auth Java deserialization to root — VERIFIED-AT-PRIMITIVE showcase artifact (rebuilt twins; appliance not executed, entitlement-gated)
PoC: B63-POC-CVE-2026-75650
CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test
PoC: CVE-2026-98260-pudding-android
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
PoC: node2shell-detector
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
PoC: hdu-is-work1
Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)
PoC: php81-el7-php2shell
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
PoC: sl0ppy-riftscan-CVE-2026-42945
riftscan module for metasploit msf for cve CVE-2026-42945
PoC: CVE-2026-84589-macOS-TCC-Bypass
CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.
PoC: php2shell-fixer
Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers
PoC: PHP-CVE-2026-115560-Cheker-v-1.0
PHP alerta de CVE-2026-115560 PERO SABES SI TUS SISTEMAS SON VULNERABLES? Bueno amigos hice un script que checa si eres vulnerable y te dice exactamente que parámetros modificar para no estar vulnerable pero la buena noticia es que, según el propio proyecto, se trata de un riesgo poco probable en la práctica.
PoC: test-php
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
PoC: CVE-2026-109618
CVE-2026-109618 - PHP session.upload_progress Heap UAF Pre-Auth RCE (CVSS 9.2)
PoC: CVE-2026-109619
CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)
PoC: http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
PoC: php2shell-behind-nginx
php2shell (CVE-2026-109618/9) behind nginx: measurements, lab, and an app-LFI chain that survives a proxy
PoC: CVE-2026-116106
CVE-2026-116106 - HeyCyan App 1.0.103 (Android) controle de acesso incorreto no FileProvider (CWE-284) - VulDB VDB-426174
PoC: CVE-2026-116105
CVE-2026-116105 - HeyCyan App 1.0.103 (Android) transmissao em texto claro / cleartext transmission (CWE-319) - VulDB VDB-426173
PoC: C-A-S
C.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan discovery, HTTP/WS-Management testing, batch scanning, and vulnerability logging.
PoC: php2shell-monitor-rz
PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts
PoC: msgpack-CVE-2021-23410-test.hpp
the improve SourceInfo UX around server:
PoC: php2shell-unchained
Isolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario patch & WAF audit, Sliver C2, Cloudflare Quick Tunnel + Tor egress, guided mitigation validation.
PoC: Root-My-Galaxy-Payloads-SM-S928B
SM-S928B / S928BXXU6EZIF port of the CVE-2026-43499 app payload - work in progress, not yet rooted
PoC: CVE-2026-0073
CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. Includes functional Python and standalone C exploits to gain unauthenticated remote shell on Android devices with Wireless Debugging enabled.
PoC: CVE-2025-26326
CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)
PoC: CVE-2024-6387-how-to-fix
Guia de correcao e mitigacao da CVE-2024-6387 (regreSSHion / OpenSSH) (recuperado)
PoC: Cloudflare-Exploits-CVE-2026-14440-CVE-2026-3125-CVE-2025-0651
PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1
PoC: Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
PoC: PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.
PoC: Galaxy-Tab-S10FE-Root
One-command ADB root for Samsung Galaxy Tab S10 FE (SM-X520, X520XXSACZH6): CVE-2026-43499 GhostLock exploit + KernelSU late-load. No bootloader unlock.
PoC: Fortinet-Exploits-CVE-2026-39808-106173-107656
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
PoC: bug-free-broccoli
CVE-2026-59248
PoC: php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-only version check script.
PoC: http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.
PoC: CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
PoC: CVE-2026-106781
CVE-2026-106781 CH341SER Driver Installer Privilege Escalation
PoC: CVE-2026-112900-PoC
Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).
PoC: Root-My-Galaxy-S4
Root the Samsung Galaxy S4 on official firmware via CVE-2015-1805 & KNOX e-fuse stays intact
PoC: ksu-root
在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。
PoC: CVE-2026-115560
PHP session.upload_progress Enabled - CVE-2026-115560 Precondition
PoC: php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
PoC: cve-2026-98260-vivo-gki-research
Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)
PoC: brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
PoC: php2shellX
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification (URL/host/port/path/batch), multi-format output (JSON/CSV/table), resume capability, and lab automation (Docker restart). Authored by TESTERXMA.
PoC: a12-ghostlock
One-click root for the Samsung Galaxy A12 (SM-A125F) via CVE-2026-43499 (GhostLock) - KernelSU-compatible userspace stack, grant dialog, verified root in Neo Backup / App Manager / Shizuku
PoC: o3root
Shizuku-driven CVE-2026-98260 root + KernelSU runtime LKM loader for Xiaomi yingtian / lhasa (kernel 6.18.21)
PoC: homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
PoC: php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
php:7.4-fpm-CVE-2026-109618-109619-free
PoC: cve-2026-25262-poc
CVE-2026-25262 (Qualcomm BootROM) deep-dive on the Black Hat Asia 2026 'A journey through Sahara' talk + read-only Sahara/EDL recon harness. GPLv3.
PoC: CVE-2026-74580
CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit
PoC: php2shell
Патчи безопасности и сканер аудита для FastPanel и Debian PHP против уязвимостей CVE-2026-109618 и CVE-2026-109619 (PHP 5.2–8.1). Пошаговые руководства по сборке.
PoC: log4shell-audit-4
Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: CEV-2020-25213_wp-file-manger_exploit
CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only
PoC: php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-115560
PoC: CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
PoC: Compiled-CVE-2023-21752
Compiled version of Wh04m1001's exploit for iwr/wget delivery to VM.
PoC: CVE-2026-83548
CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF
PoC: CVE-2026-64849
CVE-2026-64849 — MLflow SSRF
PoC: CVE-2026-21627
CVE-2026-21627 proof of concept and exploit script
PoC: php8.1-cve-109618-109619-fix
php:8.1.34-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php7.4-cve-109618-109619-fix
php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php2shell
Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and RCE via session.upload_progress memory bailout dangling pointers.
PoC: php2shell-demo
🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next.js sharp. See the attack surface and blast radius, and learn to shut them down. No exploits.
PoC: CVE-2026-115560
CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.
PoC: CVE-2026-86426
CVE-2026-86426 CHECK
PoC: php-radar
Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network perimeter, and AWS, and grades each install by version and config without triggering the bug.
PoC: spip-cve-2026
PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18
PoC: php2shell
PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619
PoC: php2shell-audit
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
PoC: DFRoot
Fork of datfooldive/DFRoot (DirtyFrag CVE-2026-43284, ReSukiSU) + GitHub Actions APK build
PoC: php8-cve-109618-109619-fix
php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: brotli-secfix
Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.
PoC: CVE-2026-88009-PoC
CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.
PoC: CVE-2026-85595-PoC
CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.
PoC: CVE-2026-85168-PoC
CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.
PoC: CVE-2026-86076-PoC
CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.
PoC: CVE-2026-109618-CVE-2026-109619-php2shell-
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
PoC: CVE-2026-111497-node2shell
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free