CVE-2026-22034 is a critical flaw in Snuffleupagus, the PHP hardening module, scored 9.8. If the optional upload validation feature uses a VLD based script and the VLD extension is missing for the command line PHP, files in multipart uploads are run as PHP code. The fix is version 0.13.0, so upgrade or turn the feature off.
What's affected
- Product: Snuffleupagus, a PHP module that blocks bug classes and offers virtual patching (jvoisin)
- Affected: version 0.12.0 and earlier
- Fixed: 0.13.0
- Conditions: all of these must hold. Upload validation is enabled, which is not the default. It is configured to use one of the project's validation scripts that rely on the Vulcan Logic Disassembler (VLD). The VLD extension is not available to the command line PHP SAPI that runs the script
- Status: not in the CISA Known Exploited Vulnerabilities catalog
If any condition is false, this flaw does not apply as described. The record and the GitHub advisory agree on the version range.
How to check if you're exposed
Start by finding out whether Snuffleupagus is loaded and whether upload validation is configured at all.
php -v
php -m | grep -i snuffleupagus
grep -rn "upload_validation" /etc/php* /etc/snuffleupagus* 2>/dev/null
The first command usually shows the Snuffleupagus version in its banner. If no rule file mentions upload validation, you are outside the affected setup.
If the feature is on, check the last condition. Run the same PHP binary that the validation script uses, which is the command line one, and look for VLD:
php -m | grep -i vld
If VLD is missing there, the validation script cannot do its job as designed. That is the setup the advisory describes, and you should treat the host as exposed until you upgrade.
What to do now
- Check every PHP host for Snuffleupagus with the commands above, including containers and shared hosting accounts.
- Upgrade to Snuffleupagus 0.13.0 or later.
- If you cannot upgrade today, turn off upload validation in the rule file, or install VLD for the command line PHP so the validation script runs.
- Review web roots and upload folders for files that should not be there, and check logs for unusual multipart requests.
- Put a check for the VLD extension into your deployment tests so a missing extension fails the build.
Why it matters
Snuffleupagus can inspect uploaded files before PHP code sees them. The project ships validation scripts, written in PHP and Python, that use VLD to disassemble an upload and check whether it contains code. That design only works when the pieces are all present.
The advisory explains how it breaks. PHP keeps running when an extension cannot be loaded, and it prints a warning and carries on. In the missing VLD case, the validation step did not do what its name says, and the result was that the content of each uploaded file in a multipart request was evaluated as PHP. The record puts it plainly: all files from multipart POST requests are evaluated as PHP code. The class is CWE-636, failing open. When a safety check cannot run, the system should refuse the request, and here it accepted it.
This is a good example of a security control that adds risk when it is half installed. A hardening module is part of your attack surface, and the configuration around it deserves the same tests as the application. A deployment check that confirms the VLD extension loads under the command line SAPI would have caught the problem before it reached production.
The impact is unusually direct. Anyone who can send a file upload to an affected application could run code with the permissions of the web server. For many sites that means reading application secrets, changing content and reaching the database.
Upgrading is better than patching around the configuration. The advisory names 0.13.0 as the patched release, and a configuration workaround leaves the setup as fragile as before.
If you run PHP behind other hardening tools, repeat the exercise: for each control, ask what happens when it fails to load, and test that case on purpose.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Snuffleupagus vulnerable by default?
No. The advisory says upload validation is a non-default feature. You need it enabled and using a VLD based script, with VLD missing for the command line PHP.
If I install VLD, am I safe?
That removes the condition the advisory describes, but the project fixed the code in 0.13.0. Upgrade as well, so a future missing extension does not bring the problem back.
Sources
Last reviewed: 19 October 2026.
