CVE-2026-44262·PHP vulnerability
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
- Severity
- critical
- Software
- PHP
- Published
- 2026-05-12
How to fix this CVE
Upgrade Scramble to version 0.13.22 or later. If upgrading is not possible, restrict access to documentation endpoints (/docs/api, /docs/api.json) via middleware or reverse proxy rules. In production, documentation endpoints should never be publicly accessible.
# Update via Composer:
cd /var/www/html && composer require dedoc/scramble:'^0.13.22'
# Verify: composer show dedoc/scramble | grep versions
# Restrict access in production (add to routes/web.php):
# Route::middleware('auth')->group(fn() => Scramble::routes());
php artisan config:cacheDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
GET /docs/api.json HTTP/1.1
The attacker first accesses the public API documentation endpoint to enumerate validation rules. When validation rules reference user-controlled input (e.g., Rule::in(request()->input('values'))), the documentation generation evaluates these rules, allowing the attacker to inject parameters that influence server-side behavior during documentation rendering.WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
# Block public access to Scramble documentation endpoints:
SecRule REQUEST_URI "@rx ^/docs/api" "id:20264426,phase:1,deny,status:403,msg:'CVE-2026-44262 Scramble docs endpoint blocked',severity:HIGH"
# Nginx:
location /docs/api { deny all; return 403; }How to check if you are affected
- Check Scramble version: composer show dedoc/scramble 2>/dev/null | grep versions — vulnerable if 0.13.2 to 0.13.21
- Check if docs endpoints are publicly accessible: curl -s -o /dev/null -w '%{http_code}' https://yoursite.com/docs/api
- Search for Scramble in project: grep -r 'scramble' composer.json
- Check if documentation routes are behind auth middleware: grep -r 'Scramble::routes' routes/
- Review validation rules for user-controlled input: grep -rn 'Rule::in.*request()' app/
Indicators of compromise
- Unusual traffic to /docs/api or /docs/api.json from external IPs
- Request parameters containing validation rule injection payloads
- Server-side requests triggered by documentation endpoint access
- Error logs showing unexpected validation rule evaluation
FAQ
What is Scramble?
Scramble is a popular Laravel package that automatically generates OpenAPI/Swagger documentation from your Laravel code, including route definitions, validation rules, and response types. It is widely used in Laravel API projects.
Should API documentation be public in production?
Generally no. API documentation endpoints should be behind authentication in production. Public documentation exposes your API structure and, in this case, can be exploited. Use middleware to restrict access.
Does this affect all Laravel projects using Scramble?
Only if the documentation endpoints are publicly accessible AND validation rules reference user-controlled input (like request()->input()). Projects with documentation behind auth middleware have reduced risk.
Is this a Laravel vulnerability?
No. This is specific to the Scramble package, not Laravel itself. However, it highlights the risk of dynamically evaluating validation rules during documentation generation.
What should I do immediately?
1) Check if /docs/api is publicly accessible on your production site. 2) If yes, restrict access immediately via middleware or reverse proxy. 3) Update Scramble to >= 0.13.22.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-44262. Free for 1 server.
Get started free