What is CVE-2026-46420?

CVE-2026-46420 is a medium-severity vulnerability in Shivammathur Setup-php, classified under OS Command Injection. CVSS score: 5.6/10. Published 2026-07-17.

How severe is CVE-2026-46420?

Medium severity. CVSS v3 base score is 5.6 out of 10.

RCE in Shivammathur Setup-php

CVE-2026-46420

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-vers…

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Shivammathur Setup-php — versions >= 2.25.0, < 2.37.1

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46420?: CVE-2026-46420 is a medium-severity vulnerability in Shivammathur Setup-php, classified under OS Command Injection. CVSS score: 5.6/10. Published 2026-07-17.
How severe is CVE-2026-46420?: Medium severity. CVSS v3 base score is 5.6 out of 10.