CVE-2017-9841: listed in the CISA KEV catalog

CVE-2017-9841 · CVSS 9.8 CRITICAL · EPSS 100.0% · KEV 2022-02-15

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Is CVE-2017-9841 exploited?

• Listed in the CISA KEV catalog on 2022-02-15.
• Federal remediation due 2022-08-15.
• Past that date by 1461 days.
• EPSS puts exploitation in the next 30 days at 100.0%.
• Public exploit code: proof of concept.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2017-9841

• Stray PHPUnit Test Files Keep Exposing Production Servers (2026-05-18)

Primary sources

• NVD record
• CISA KEV catalog
• Exploit-DB 50702
• Nuclei template

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.