GCVE-110-COMPOSER-2026-003650

Advisory Published

Vulnetix · Advisory published June 18, 2026

[PHP-SHELL-EXEC-VAR] PHP OS command execution sink invoked on a variable — matched: exec($command, $output, $status);

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Vendor	Product	Versions	Platforms
packagist	pablohaedo/cakephp-queue	* (affected)	—

advisory

web

Investigate this vulnerability in the interactive console or download the raw GCVE record.