Detect CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names in Elastic Security
Detects exploitation and presence of CVE-2026-54133, a CVSS 9.8 code injection (CWE-94) vulnerability in mtdowling/jmespath.php prior to version 2.9.1. The library's CompilerRuntime writes compiled PHP expression code to disk and includes it. Function names supplied within a JMESPath expression are not properly escaped/sanitized before being emitted into the generated PHP source, allowing an attacker who controls the JMESPath expression (or a function name within it) to inject arbitrary PHP that is then written to the compiler cache directory and executed via include. Detection focuses on suspicious writes to the jmespath compiler cache directory (typically system temp with jmespath_* filenames), anomalous PHP process behavior downstream of JMESPath usage, and web requests carrying JMESPath-like injection payloads.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
sequence by host.name with maxspan=5m
[ file where event.type in ("creation", "change") and
file.name regex~ "jmespath_.*\.php" and
file.path : ("*/tmp/*", "*\\Temp\\*", "*/var/tmp/*") ]
[ process where event.type == "start" and
process.name : ("php", "php-fpm", "php-cgi") and
process.command_line : ("*system(*", "*shell_exec(*", "*passthru(*", "*proc_open(*", "*eval(*", "*base64_decode(*") ]Sequence rule: a jmespath compiler-cache PHP file is written then a PHP process spawns invoking OS command primitives within 5 minutes on the same host.
Data Sources
Required Tables
False Positives & Tuning
- Benign JMESPath expression compilation writing cache files during normal operation.
- Legitimate PHP CLI scripts that use shell primitives unrelated to jmespath.
- Automated deployment steps that pre-warm the compiler cache.
Other platforms for CVE-2026-54133
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malicious jmespath compiler-cache file write
Expected signal: File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.
- Test 2Execute injected PHP compiler-cache payload
Expected signal: PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.
- Test 3Vulnerable jmespath.php code-injection PoC (lab)
Expected signal: jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.
Response Playbook
Triage
- Confirm whether mtdowling/jmespath.php is a dependency of the affected host's PHP application and identify its installed version via `composer show mtdowling/jmespath.php` or by inspecting composer.lock — versions < 2.9.1 are vulnerable.
- Inspect the jmespath compiler cache directory (default sys_get_temp_dir(), e.g. /tmp or the OS temp path) for jmespath_*.php files and read their contents for injected PHP (calls to system/exec/shell_exec/eval/base64_decode or unexpected function-name-derived code).
- Determine whether the application passes user-controlled input into JMESPath expressions or function names, and review web/application logs for requests carrying JMESPath-like payloads around the file-write timestamps.
- Correlate the file-write events with downstream PHP process executions to establish whether injected code actually executed.
Containment
- Isolate the affected host from the network if injected code execution is confirmed, and suspend the exposed application/endpoint accepting attacker-controlled JMESPath input.
- Delete malicious jmespath_*.php cache files and rotate any credentials, tokens, or secrets accessible to the PHP process (web app service account, DB creds, API keys).
- Block the source IPs delivering the injection payloads at the WAF/edge and disable CompilerRuntime (use AstRuntime) until patched.
Evidence Collection
- Preserve the contents and metadata (timestamps, ownership) of all jmespath_*.php files in the compiler cache directory before deletion.
- Collect web server access/error logs, PHP-FPM logs, and application logs covering the exploitation window along with process-execution telemetry (Sysmon/auditd/EDR).
Escalation Criteria
- !Escalate to incident response if any jmespath_*.php cache file contains injected OS-command or eval primitives, or if correlated PHP command execution is observed.
- !Escalate if the affected application is internet-facing and accepts untrusted JMESPath expressions, or if evidence of lateral movement, data exfiltration, or credential theft from the PHP host is found.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
jmespath_*.php files in the system temp / compiler cache directory (contents, mtime, owner). - >
Web server and PHP-FPM access/error logs showing the malicious request and JMESPath payload. - >
EDR/Sysmon/auditd records of PHP process spawns invoking command or eval primitives. - >
composer.lock entry confirming vulnerable mtdowling/jmespath.php version < 2.9.1.
Tuning Guidance
Baseline the normal set of jmespath_*.php filenames and cache directories produced by your legitimate applications during a known-good period; alert only on cache files whose contents contain OS-command or eval primitives, or on cache writes correlated with suspicious PHP process execution. In environments that use AstRuntime (no on-disk compilation) or have upgraded to >= 2.9.1, the file-write leg should never fire and can be treated as high-fidelity. Suppress developer/CI hosts by asset group to reduce noise from test artifacts.
Hunting Queries
Enumerate all hosts that have written jmespath.php compiler-cache files, then manually inspect each file's contents for injected code.
DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php" | join kind=inner (DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php") on DeviceName | summarize count(), makeset(FolderPath) by DeviceName, FileNameindex=* (TargetFilename="*jmespath_*.php" OR file_path="*jmespath_*.php") | stats count values(TargetFilename) values(file_path) by host | where count > 0Atomic Red Team Tests
Writes a jmespath_*.php file containing an injected command primitive into the temp directory to emulate the artifact produced by CVE-2026-54133 exploitation.
Command
printf '<?php system("id"); // injected via unescaped function name\n' > "/tmp/jmespath_$(printf %04d 1).php" && cat "/tmp/jmespath_0001.php"Cleanup
rm -f /tmp/jmespath_0001.phpExpected Telemetry
File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.
Expected Detection
KQL/EQL/CQL file-write rules match on jmespath_*.php in a temp path; contents contain a command primitive.
Executes a jmespath-style compiler-cache PHP file that invokes a shell command, emulating the include of injected code by CompilerRuntime.
Command
printf '<?php echo shell_exec("whoami");\n' > /tmp/jmespath_test.php && php /tmp/jmespath_test.phpCleanup
rm -f /tmp/jmespath_test.phpExpected Telemetry
PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.
Expected Detection
Process-execution rules match PHP invoking shell_exec/command primitives correlated with the cache-file write.
Runs a PHP snippet using CompilerRuntime with an attacker-influenced function name to demonstrate code injection on a vulnerable mtdowling/jmespath.php < 2.9.1 install in an isolated lab.
Command
php -r 'require "vendor/autoload.php"; $r = new \\JmesPath\\CompilerRuntime(sys_get_temp_dir()); echo $r("malicious_fn(@)", ["a"=>1]);' 2>&1 | head -n 20Cleanup
rm -f /tmp/jmespath_*.phpExpected Telemetry
jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.
Expected Detection
Correlated file-write plus PHP command-primitive execution alerts fire; cache file contents reveal the injected function name.