CVE-2026-22034
Critical
Description
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductJvoisin Snuffleupagus
PublishedJan 8, 2026
First seenJan 8, 2026
Weakness typeCWE-636CWE-636
How to fix
Update
- jvoisin snuffleupagus0.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jvoisin snuffleupagus | v < 0.13.0 | 0.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.