CVE-2026-55599

phpseclib, a PHP library for secure communications, allowed the X509::validateSignature() method to read the Authority Information Access (AIA) URL from an untrusted X.509 certificate and open a connection to that URL. This behavior enabled an attacker who supplied a crafted certificate to force the validating server to issue outbound requests to arbitrary hosts, ports and paths, potentially reaching internal or cloud‑metadata endpoints. The flaw grants an unauthenticated attacker the ability to traverse network boundaries that should be protected, resulting in data exposure or further exploitation within the target environment.

Applications that depend on phpseclib versions 0.1.1 through 1.0.30, 2.0.55, and 3.0.54 are vulnerable. Upgrading to the fixed releases—1.0.30, 2.0.55, or 3.0.54—removes the bug. All other versions are not affected.

The CVSS score of 5.8 indicates moderate severity. Because no EPSS score is available, the expected exploitation rate is unknown, but the absence of KEV listing suggests limited or no active exploitation to date. The vulnerability can be triggered by any party that can supply a certificate to the application; therefore the attack vector is primarily via untrusted certificate validation, often resulting from compromised certificate stores or trust‑elevated inputs.