The vulnerability in PHPUnit allows an attacker who can write to the file system to place a malicious serialized object in a hidden ".coverage" file that is automatically deserialized during PHPT test execution. When code coverage instrumentation is enabled, the deserialization call in the cleanupForCoverage() method fails to restrict the classes that can be instantiated, triggering any “'__wakeup'” logic defined in the object. This flaw can lead to arbitrary code execution in the context of the test runner, potentially allowing the attacker to run malicious code, modify artifacts, or exfiltrate data. The impact is severe because any environment that runs PHPUnit tests with coverage enabled becomes vulnerable if it permits writes to the coverage directory.

The affected products are PHP Unit testing framework versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52. The vendor is Sebastian Bergmann, the primary maintainer of PHPUnit. The issue is relevant to all installations that use PHPT test execution and enable code coverage, as the flaw resides in the cleanupForCoverage() method that processes coverage files. The fix is delivered in the releases 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52, which now raise an explicit error when a pre‑existing ".coverage" file is found.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests the flaw is unlikely to be widely exploited at this time. The vulnerability is not listed in the CISA KEV catalog, further implying a lower current exploitation risk. However, exploitation requires the attacker to have write access to the local file system used by PHPUnit to store coverage data. In CI/CD pipelines or shared development environments, gaining such access can be achieved through compromised dependencies or misconfigured runners, enabling the attacker to trigger arbitrary code execution during test runs. The most probable attack vector therefore involves a trusted CI/CD pipeline that has write access to the workspace, combined with code coverage turned on.