CVE-2026-42610: Php Iterable Config Command Injection

Unescaped iteration variables flow into OS command execution. An attacker who controls the iterated array or configuration can inject arbitrary shell commands or overwrite arguments. Ensure array or iterable variables are rigorously sanitized using `escapeshellarg()` or `escapeshellcmd()` before being concatenated into a command string for shell execution fu

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0PHP
greprules fetch cve-2026-42610-php-iterable-config-command-injection --engine opengrep

Description

Unescaped iteration variables flow into OS command execution. An attacker who controls the iterated array or configuration can inject arbitrary shell commands or overwrite arguments. Ensure array or iterable variables are rigorously sanitized using `escapeshellarg()` or `escapeshellcmd()` before being concatenated into a command string for shell execution fu