CVE-2026-10273: php-censor Webhook Endpoint GitBuild.php os command injection

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-07-22
Weakness: CWE-77

Description

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named cd68d102601320bd319d590b75f7652e66f0685f. It is recommended to apply a patch to fix this issue.

Affected products

php-censor: 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+1)

References

https://github.com/php-censor/php-censor/
https://github.com/php-censor/php-censor/commit/cd68d102601320bd319d590b75f7652e66f0685f
https://github.com/php-censor/php-censor/issues/442
https://github.com/php-censor/php-censor/pull/441
https://vuldb.com/cve/CVE-2026-10273
https://vuldb.com/submit/825315
https://vuldb.com/vuln/367552
https://vuldb.com/vuln/367552/cti
https://github.com/php-censor/php-censor/pull/441

Get alerted when CVE-2026-10273 or the next vulnerability affects your stack