CVE-2026-40176

CVE-2026-40176 — Composer Perforce Driver Command Injection Proof of Concept A self-contained, OOP-style PHP proof of concept that demonstrates and differentially verifies a command-injection vulnerability in Composer's Perforce repository driver. The PoC runs the same malicious composer.json...

cve-2026-40176-cve-2026-40261

CVE-2026-40176 Composer Perforce Repository Remote Code Execution RCE 📋 Summary Command Injection vulnerability in Composer's Perforce repository driver allowing Remote Code Execution RCE through insufficient input validation in repository URL processing. 🎯 Vulnerability Details Property| Value...

composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION THIS REPOSITORY CONTAINS PROOF-OF-CONCEPT CODE FOR VULNERABILITIES CVE-2026-40261 AND CVE-2026-40176 IN COMPOSER. !CAUTION THE CODE IS INTENDED FOR EDUCATIONAL AND TESTING PURPOSES ONLY. !CAUTION DO NOT USE THIS CODE IN PRODUCTION ENVIRONMENTS OR AGAINST SYSTEMS WITHOUT PROPER...

p4wned

P4WNED CVE-2026-6043 Perforce Helix Core security research tools and nuclei templates. Research article: https://morganrobertson.net/p4wned/ Please read the above for complete details. Authorised targets only. Use on your own servers or with explicit written permission. Intended audience: Perforc...

CVE-2026-84361-poc

CVE-2026-84361: Composer Perforce P4PORT Command Execution PoC Run with Docker Docker Compose provides an isolated image containing vulnerable Composer 2.10.2 and the Perforce p4 client. At runtime it has no network, a read-only root filesystem, no Linux capabilities, and writable tmpfs mounts on...

CVE-2026-40176-poc

CVE-2026-40176: Composer Perforce OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-40176 , a critical OS Command Injection vulnerability discovered in Composer 's Perforce VCS driver versions prior to 2.2.27 and 2.9.6. The vulnerability exists in t...

CVE-2026-109758

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

CVE-2026-109758

The Perforce Helix Authentication Service (HAS) (versions 2022.1 - 2025.2) is vulnerable to unauthorized access because the installer copies a default SCIM bearer token into the active configuration instead of generating a random one. An attacker who knows this default token can authenticate to t...

EUVD-2026-98279

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies int...

CVE-2026-109758

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

CVE-2026-109758

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

CVE-2026-109758: Improperly Controlled Modification of Object Prototype Attributes

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method. This method constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client...

CVE-2026-103507

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-100102

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server...

CVE-2026-100103

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

EUVD-2026-92307

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner...

CVE-2026-103512: Authentication Bypass by Spoofing

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner...

CVE-2026-103507: External Control of File Name or Path

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

PT-2026-104760

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner...