The vulnerability occurs when PHPUnit tests with code coverage create temporary files in a predictable directory under the system temporary path. The framework does not verify ownership or permissions of the directory, allowing a local user on a system with a shared temporary path to pre-create the directory and replace the coverage job file with a malicious file. When the child process later requires this file, the malicious code executes with the developer’s privileges, while the test appears to succeed. This flaw enables local code execution without needing elevated rights and is classified as CWE-379.

The affected product is PHPUnit from Sebastian B. The flaw exists in releases 13.4.0 through 13.4.4. Earlier versions such as 12.5 and below, as well as environments with per‑user temporary directories on macOS and Windows, are not impacted.

The CVSS score of 5.4 indicates moderate severity, but the vulnerability’s impact is significant because it leads to code execution. EPSS is not available, and the flaw is not listed in CISA KEV, suggesting it is not a widely known exploitation vector yet. The attack vector is local; it requires a user with access to the shared temporary directory on a multi‑user system. If such a user can create or modify files in the temp directory, they can replace the job file, forcing execution of arbitrary code in the developer’s context.