GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-86427: Php Rrdtool Graph Option Argument Injectioncve-2026-86427-php-rrdtool-graph-option-argument-injection

Unescaped dynamic value $VAL is emitted as an rrdtool graph option $FLAG. rrdtool options are space-joined into a single command line/stdin stream, so a double quote in $VAL terminates the option token and a CR/LF starts a new rrdtool command. An attacker controlling this free-form string (e.g. the graph_title request parameter stored in user_title and re-em

PHPCVE-2026-86427CWE-150CWE-88
by Provallyupdated 2026-10-27Apache-2.0
460 direct46 via packs
83
All matching rules loaded.