CVE-2015-10141
Xdebug Remote Debugger Unauthenticated OS Command Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.
| CWE | CWE-78 CWE-306 |
| Vendor | xdebug |
| Product | xdebug |
| Published | Jul 23, 2025 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for xdebug xdebug
Be the first to know when new unknown vulnerabilities affecting xdebug xdebug are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Xdebug / Xdebug
* ≤ 2.5.5
References
xdebug.org: https://xdebug.org/ kirtixs.com: https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/ web.archive.org: http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/ exploit-db.com: https://www.exploit-db.com/exploits/44568 fortiguard.com: https://www.fortiguard.com/encyclopedia/ips/46000 vulncheck.com: https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution
Credits
Ricter Zheng