Medium [CVE-2026-59856] Arbitrary code execution via crafted PHP file in omni-completion
This medium-severity Red Hat Linux advisory covers CVE-2026-59856 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4.22.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping.
A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the:! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion.
This issue is fixed in version 9.2.0736. The PHP omni-completion script improperly handles specially crafted input.
Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products.
The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk." Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Weakness: CWE-94.
- < 9.2.0736
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
- 9.2.0736
- vim-2:9.1.083-9.el10_2.12
- vim-2:9.1.083-5.el10_0.4
- vim-2:8.2.2637-26.el9_8.13
- rhcos-4.22.9.8.202608130832-0
- vim-main-9.2.780-1.hum1
- insights-proxy/insights-proxy-container-rhel9:1786433656
- rhui5/cds-kubernetes-rhel9:1786435241
- rhui5/cds-rhel9:1786533457
- rhui5/haproxy-rhel9:1786533449
- rhui5/installer-rhel9:1786435483
- rhui5/rhua-rhel9:1786533529
- rhui5/cds-kubernetes-tp-rhel9:1787241211
- rhui5/installer-tp-rhel9:1787135742
- rhui5/rhua-tp-rhel9:1787241260
- RHSA-2026:48650
- RHSA-2026:55431
- RHSA-2026:47982
- RHSA-2026:54769
- RHSA-2026:35387
- RHSA-2026:53371
- RHSA-2026:54387
- RHSA-2026:58981
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Mitigation checklist
- Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.