The vulnerability lies in the way shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock, platform-overrides.php, and the Composer config. From 2.25.0 through 2.37.0, these values were incorporated directly into generated shell or PowerShell setup scripts without sufficient validation, allowing an attacker who controls repository contents and triggers the workflow with pull_request_target to inject arbitrary commands into the runner. This command injection flaw (CWE‑78) can lead to full remote code execution on the CI environment. The issue is fixed in version 2.37.1.

The affected component is shivammathur's setup‑php GitHub Action. Versions 2.25.0 through 2.37.0, inclusive, are vulnerable. The action is valued in CI pipelines that install PHP, extensions, and configuration. Version 2.37.1 contained the fix and should be deployed to all workflows that use the action.

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is under 1%, showing a low current exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is a workflow that uses pull_request_target and checks out attacker‑controlled content before the action runs. If an adversary supplies a malicious version file or composer configuration, they can inject shell or PowerShell commands executed with the runner’s privileges, leading to full remote code execution on the build environment.