by Kastro
Paper/Archive/CVE-2026-44262

CVE-2026-44262

dedoc scramble — Scramble: Remote code execution via evaluation of user-controlled input in validation rules

EPSS 6%CVSS 9.4
critical.is priorityof 100
47
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 93.2.932 × 2018.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.

Affected

ProductAffectedFixed inSource
scramble>= 0.13.2, < 0.13.22–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39refgithub.com/dedoc/scramble/releases/tag/v0.13.22