This vulnerability allows an attacker who can write to a directory that a user later uses as the current working directory to inject arbitrary PHP code via a file named .psysh.php. When PsySH starts it automatically loads and executes such a file, so a privileged user running PsySH will execute the attacker’s code with the same privileges. The flaw stems from unsanitized path handling and is classified as CWE‑427, an environment variable or path manipulation issue leading to arbitrary code execution. The attack, if successful, grants complete control over the system under the victim’s permissions, which can be exploited by root, CI runners, or any other privileged account that launches PsySH.

Affected products include the PsySH console from bobthecow, specifically versions earlier than 0.11.23 and 0.12.19. Downstream consumers that embed PsySH, such as Laravel Tinker (php artisan tinker), inherit the same risk because they rely on the same auto‑load mechanism. Any user who runs these tools with elevated privileges from a directory that is writable by an attacker is susceptible.

The CVSS score of 6.7 indicates a moderate severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is local; it requires the attacker to write a malicious .psysh.php file to a directory that the victim will later use as the current working directory when launching PsySH or a dependent tool. Once the victim runs the tool with elevated privileges, arbitrary code execution occurs, effectively escalating privileges to the user’s level.