CVE-2026-22034

CVE-2026-22034 describes a critical vulnerability in Snuffleupagus versions prior to 0.13.0, specifically when the non-default upload validation feature is enabled and configured to use VLD-based scripts without the VLD extension available to the CLI SAPI. This misconfiguration allows all files from multipart POST requests to be evaluated as PHP code, leading to arbitrary code execution. With a CVSS score of 9.2 (CRITICAL), the vulnerability has a low attack complexity and no user interaction is required, allowing an unauthenticated attacker to achieve high confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.