chore(deps): update shivammathur/setup-php action to v2.37.1 [security]

Details

Summary

A command injection vulnerability was identified in shivammathur/setup-php when the action resolves the PHP version from repository-controlled files and uses that value while generating the platform setup script.

In affected versions, setup-php may read the PHP version from:

• .php-version
• composer.lock via platform-overrides.php
• composer.json via config.platform.php

If an attacker can influence one of these files and the workflow executes setup-php in a trusted context, they may be able to execute commands on the GitHub Actions runner.

Impact

This issue is exploitable when setup-php is run after checking out attacker-controlled repository contents and resolves the PHP version from repository files.

The most significant example is a privileged workflow such as pull_request_target that checks out untrusted pull request code before invoking setup-php. Similar risk can also arise in other workflows that operate on attacker-controlled refs, branches, or repository contents in a trusted context.

This is not a separate security boundary when an attacker can already modify the workflow definition itself or directly control the php-version workflow input, since that level of access already permits arbitrary command execution in GitHub Actions.

Technical details

In affected versions, repository-derived PHP version values were insufficiently constrained before being incorporated into the generated shell or PowerShell setup script executed by the action. This could allow attacker-controlled values from supported repository files to influence script execution in trusted workflow contexts.

Remediation

If you are using shivammathur/setup-php@v2, no action is needed on your end. Users who pin the setup-php release version or release version SHA should upgrade to a patched version.

The fix validates PHP version inputs, constrains manifest-derived versions, hardens script generation at the execution, and includes additional checks in related input-handling paths.

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• https://github.com/shivammathur/setup-php/security/advisories/GHSA-pqwm-q9pv-ph8r
• https://github.com/shivammathur/setup-php/commit/eeef37e059fb5368a5bc8ed8ce45ff54bd39b80b
• https://github.com/advisories/GHSA-pqwm-q9pv-ph8r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

This affects only workflows that pin an exact affected Composer semver version through setup-php, for example tools: composer:2.9.7.

Workflows using the default Composer version, composer:v2, or no pinned Composer version are not affected through setup-php, because those Composer URLs have been updated to patched Composer releases for all setup-php versions.

setup-php does not directly print the token. The token may be exposed through Composer when Composer validates github-oauth auth and rejects GitHub's newer hyphen-containing token format.

Public repository logs may expose the token. GitHub-hosted runner GITHUB_TOKEN values expire after the job, but exposure may still matter during the token lifetime and for longer-lived GitHub App or user tokens.

Patches

setup-php 2.37.1 skips generated GitHub OAuth auth for pinned Composer versions affected by Composer GHSA-f9f8-rm49-7jv2 while preserving other Composer auth, including Packagist auth.

Workarounds

Upgrade to setup-php 2.37.1 or newer. You can also avoid the affected path by using a patched Composer version: 2.9.8, 2.2.28, 1.10.28, or newer supported Composer releases.

It is recommended to avoid pinning affected Composer versions such as composer:2.9.7, unless you have automations to do timely updates in your workflows.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2
• https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm
• https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4
• https://github.com/advisories/GHSA-5wxr-w449-57cm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v2.37.1

Compare Source

Changelog

Security Updates

• Fixed shell command escaping and PHP version input validation. (GHSA-pqwm-q9pv-ph8r / CVE-2026-46420)

[!NOTE] This can affect workflows that pass values from users or pull requests to setup-php, for example from comments, dispatch inputs, PR titles/branches, generated matrices, or files such as .php-version and composer.json. Be especially careful with pull_request_target workflows that use any value from the pull request. Workflows that only use fixed trusted values are not expected to be affected, but updating to 2.37.1 is recommended.

• Fixed GitHub auth handling for Composer versions affected by GHSA-f9f8-rm49-7jv2. It should now skip configuring GitHub OAuth if affected Composer versions are installed and show a warning to upgrade. (GHSA-5wxr-w449-57cm / CVE-2026-45793)

[!NOTE] This only affects workflows where the composer version is pinned like composer:2.9.7, workflows that do not pin the version or use composer:v2 are not affected as those get automatic updates. In case you pin the version, it is highly recommended to upgrade and have automation to do such timely upgrades in your workflows.

Fixes and Improvements

• Fixed support for phalcon on Windows.

• Fixed restoring tools when using cached using previous runs.

• Improved enabling gearman extension on Linux.

• Fixed fallback when installing PhpManager and VcRedist modules on Windows.

• Fixed parsing extension inputs with backslash line continuation.

• Improved workflow examples

  • Added workflow examples for Drupal 11 composer-managed projects and WordPress plugins.
  • Added workflow examples for Yii3 web applications and replaced Yii2 Starter Kit examples.
  • Updated workflow examples to use currently supported PHP versions.

• Updated OS release mappings for newer Ubuntu releases.

• Updated internal workflows for Codecov v6 and NPM trusted publishing.

• Updated Node.js dependencies.

• Fixed composer version in README. (#​1081)

Thanks @​Pyker for the contribution

For the complete list of changes, please refer to the Full Changelog

<h4>Follow for updates</h4>

v2.37.0

Compare Source

Changelog

• Updated the action to use Node.js 24. (#​1049)

• Added support for master in the php-version input. It should now set up a nightly build from the master branch of php-src.

• Added support to install ioncube and zephir_parser extensions on PHP 8.5.

• Expanded support for installing extensions using Homebrew on macOS from the shivammathur/homebrew-extensions tap. This includes pdo_firebird, sqlsrv, pdo_sqlsrv, pecl_http, swow, xhprof, and several other supported extensions.

• Improved switching PHP versions on Linux. Missing alternatives should now be registered automatically before switching versions. #​1067

• Improved support for Homebrew on macOS. It should now retry stuck brew commands with an inactivity watchdog.

• Improved support for adding tools. It should now correctly use the latest release download URL when a version is not specified. (#​1064)

• Improved tool setup and caching on self-hosted runners.

• Improved support for sqlsrv and pdo_sqlsrv on PHP 8.1 and 8.2.

• Fixed installing pecl_http on Windows. Switched to downloads.php.net for fixing ICU version post install.

• Fixed cached couchbase installs on macOS using the shivammathur/cache-extensions action.

• Replaced @actions/core with local functions to reduce bundle size.

• Refactored to use ES2024+ features for Node 24.

• Updated actions used in examples to their latest versions.

• Updated Node.js dependencies.

Thanks @​theluckystrike for the contribution 🎉

Thanks @​code-kudu, @​ssddanbrown, @​RoundingWell, and @​ntzrbtr for the sponsorship ❤️

For the complete list of changes, please refer to the Full Changelog

<h4>Follow for updates</h4>