요약
- CVE-2026-44262은(는) dedoc/scramble에 영향을 주는 심각 (CVSS 9.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 5.9%, 전체 취약점의 93.2%보다 높음.
- 조치: 0.13.22 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| dedoc/scramble Packagist | ≥ 0.13.2, < 0.13.22
| 0.13.22
|
Description
Impact
A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.
Patches
Fixed in version 0.13.22.
Workarounds
If upgrading is not immediately possible:
- Restrict access to documentation endpoints (
/docs/api, /docs/api.json)
- Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)
- Disable documentation endpoints in production environments if not required
These measures significantly reduce or prevent exploitability.
NVD description
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free