Snuffleupagus allows attackers to execute any PHP code that is uploaded through multipart POST requests when the non‑default upload validation feature is enabled and configured to use a Vulcan Logic Disassembler script, but the VLD extension is missing from the CLI SAPI. The flaw arises from a flaw in input validation (CWE‑636), causing every uploaded file to be evaluated as PHP code. This means an adversary can inject malicious PHP that the web application will execute, compromising confidentiality, integrity, and availability of the affected system.

The affected product is Snuffleupagus from jvoisin. Versions prior to 0.13.0 with upload validation enabled and configured to use VLD‑based scripts while the VLD extension is not available to the CLI SAPI are vulnerable. The vulnerability does not affect later releases of Snuffleupagus.

The CVSS score of 9.2 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers would typically use a HTTP POST request with a multipart/form‑data payload to upload a file containing PHP code; if the module interprets the file as code, it will run with the PHP process’s privileges. The issue has been fixed in version 0.13.0, so only legacy installations remain at risk.