Critical Severity
CVE-2026-115560
Published: Oct 27, 2026
PoC and Docker lab for CVE-2026-115560 — PHP session upload-progress serialize_handler mismatch to unauthenticated object injection / RCE. Validated end-to-end on php:8.4.27-apache with mitigation and no-switch controls.
# CVE-2026-115560 — PHP session upload progress serialize-handler mismatch → RCE
[](LICENSE)
[](#validated-results-2026-10-23-php8427-apache)
Proof-of-concept for the **unpatched** PHP vulnerability disclosed in the
[php.net informational advisory of 2026-10-23](https://www.php.net/archive/2026.php#2026-10-23-1),
two days after the PHP2Shell emergency release (CVE-2026-109618 / -109619).
* **Type:** unauthenticated remote code execution via session unserialize object injection
* **Status (2026-10-24):** no patch yet — handled in the regular release cycle;
official mitigation is `session.upload_progress.enabled=0`
* **Validated against:** `php:8.4.27-apache` (mod_php) — i.e. a build **fully
patched for PHP2Shell** is still vulnerable to this issue
## Advisory preconditions
All three must hold (php.net, 2026-10-23):
1. `session.serialize_handler` = `php_binary` or `php_serialize` in the **server config**
2. the application switches the handler to `php` **at runtime** via
`ini_set()` **before** `session_start()`
3. `session.upload_progress.enabled = 1` (**PHP default**)
## Root cause — verified against php-src `PHP-8.4`
Session upload progress (ext/session, the rfc1867 callback) runs **pre-RINIT**,
before any application code:
| step | source | what happens |
|---|---|---|
| write | `php_session_rfc1867_callback` → `MULTIPART_EVENT_FILE_START` → `php_rinit_session(0)` | `PS(serializer)` is resolved from the **server ini** (`php_serialize`) |
| write | `php_session_rfc1867_update()` → `php_session_flush(1)` | session file is written **immediately**, in `php_serialize` format, containing `upload_progress_<value>` as a **raw, unsanitized array key** — the value of the attacker's `PHP_SESSION_UPLOAD_PROGRESS` field. `|` is legal in a key because `php_serialize` keys are length-prefixed |
| read