PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings     to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without     neutralizing INI metacharacters. Because PHP's INI parser interprets  as a string delimiter, ; as the     start of a comment, and most importantly a newline as a directive separator, a value containing a newline     is parsed by the child process as multiple INI directives. An attacker able to influence a single INI     value can therefore inject arbitrary additional directives into the child's configuration, including     auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an     attacker-controlled path yields remote code execution in the child process. This issue has been patched in     versions 12.5.22 and 13.1.6. (CVE-2026-41570)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings
    to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without
    neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the
    start of a comment, and most importantly a newline as a directive separator, a value containing a newline
    is parsed by the child process as multiple INI directives. An attacker able to influence a single INI
    value can therefore inject arbitrary additional directives into the child's configuration, including
    auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an
    attacker-controlled path yields remote code execution in the child process. This issue has been patched in
    versions 12.5.22 and 13.1.6. (CVE-2026-41570)

ID	Name	Product	Family	Severity
313605	Linux Distros Unpatched Vulnerability : CVE-2026-41570	Nessus	Misc.	high
440653	SCA: security update for phpunit/phpunit (GHSA-qrr6-mg7r-m243)	Tenable Cloud Security	SCA Checks	high
440653	SCA: security update for phpunit/phpunit (GHSA-qrr6-mg7r-m243)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-41570

high

Tenable Plugins

high

high

high