A popular GitHub Action called setup-php, which automates the setup of PHP, extensions, and related configuration for automated code workflows, has a security flaw. Between versions 2.25.0 and 2.37.0, the tool does not properly validate PHP version information pulled from files stored in your code repository, such as .php-version, composer.lock, and composer.json. If your GitHub Actions workflows use the pull_request_target trigger (a setting that runs workflows when someone submits a pull request to your repository) and the workflow loads code from that pull request before running setup-php, an attacker could exploit this flaw to run unauthorized, harmful commands on the system that runs your workflow. The vulnerability is fully fixed in setup-php version 2.37.1. If you use this action in your GitHub workflows, updating to that version will resolve the issue.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
