{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "lcfr-hax",
          "sagitzadik-wiz",
          "tomash-areion",
          "amyb-oai"
        ],
        "summary": "reporting"
      },
      {
        "organization": "PHP Security Team",
        "summary": "remediation"
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.",
        "title": "Summary"
      },
      {
        "category": "details",
        "text": "Successful exploitation may allow an unauthenticated remote attacker with access to the SMART EMS Web UI to execute arbitrary code with the permissions of the PHP web worker and application container. The attacker may access or modify application data and credentials, alter application behaviour, establish persistence within the affected container, or disrupt the availability of SMART EMS.",
        "title": "Impact"
      },
      {
        "category": "details",
        "text": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Monitor affected systems for unexpected processes, file changes, authentication activity, and outbound network connections.\n\nWhere operationally possible, disable PHP session upload progress by setting `session.upload_progress.enabled=0` and restart all PHP workers. On PHP 8.5, additionally set `fatal_error_backtraces=0`. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. Do not apply this measure globally where SMART EMS upload functions are required. These measures reduce exposure to confirmed attack paths but are not complete mitigations.\n\nWhere exposure cannot be reduced and operational requirements permit, consider taking the affected service offline until a updated SMART EMS release is installed.",
        "title": "Mitigation"
      },
      {
        "category": "details",
        "text": "Update SMART EMS to version 3.5.4 or later.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@welotec.com",
      "name": "Welotec GmbH",
      "namespace": "https://welotec.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Welotec PSIRT",
        "url": "https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Welotec",
        "url": "https://certvde.com/de/advisories/vendor/welotec"
      },
      {
        "category": "self",
        "summary": "VDE-2026-127: Welotec: PHP2Shell Vulnerabilities in SMART EMS - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-127"
      },
      {
        "category": "self",
        "summary": "VDE-2026-127: Welotec: PHP2Shell Vulnerabilities in SMART EMS - CSAF",
        "url": "https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-127.json"
      }
    ],
    "title": "Welotec: PHP2Shell Vulnerabilities in SMART EMS",
    "tracking": {
      "aliases": [
        "VDE-2026-127"
      ],
      "current_release_date": "2026-10-29T10:00:00.000Z",
      "generator": {
        "date": "2026-10-29T10:45:21.070Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-127",
      "initial_release_date": "2026-10-29T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-29T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<3.5.4",
                    "product": {
                      "name": "SMART EMS Web Application <3.5.4",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:welotec:smart_ems:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "alpha"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.4",
                    "product": {
                      "name": "SMART EMS Web Application v3.5.4",
                      "product_id": "CSAFPID-52001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:welotec:smart_ems:3.5.4:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "SMART EMS Web Application"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Welotec"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE description"
        },
        {
          "category": "details",
          "text": "Associated weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Improperly Controlled Sequential Memory Allocation), and CWE-1419 (Incorrect Initialization of Resource). CSAF 2.0 permits one primary CWE per vulnerability; CWE-416 is used in the structured CWE field.",
          "title": "Weaknesses"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. These measures reduce exposure to confirmed attack paths but are not a complete mitigation.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update SMART EMS to version 3.5.4 or later.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "RCE via OOM corruption"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE description"
        },
        {
          "category": "details",
          "text": "Associated weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Improperly Controlled Sequential Memory Allocation), and CWE-1419 (Incorrect Initialization of Resource). CSAF 2.0 permits one primary CWE per vulnerability; CWE-416 is used in the structured CWE field.",
          "title": "Weaknesses"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, disable PHP session upload progress by setting `session.upload_progress.enabled=0` and restart all PHP workers. On PHP 8.5, additionally set `fatal_error_backtraces=0`. These settings reduce exposure to confirmed attack paths but are not a complete mitigation.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update SMART EMS to version 3.5.4 or later.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "RCE via stale global state"
    }
  ]
}