PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw

github.com | vulnerability | Critical | CVE-2026-111497 | #rce | #wordpress | #red-team | #brotli
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A source-only proof-of-concept demonstrating unauthenticated remote code execution against a pinned Docker Official Image for WordPress. The exploit chains WordPress's XML-RPC pingback.ping outbound fetch with a heap out-of-bounds write in Google Brotli (CVE-2026-111497). The malformed Brotli stream corrupts PHP's strtolower handler pointer to system without needing an address leak to bypass ASLR mode 2, executing arbitrary Bash commands on retry.

Why it matters

Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
CVE
CVE-2026-111497
Vendor
Google
Product
Brotli
Affected versions
1.0.3 - 1.2.0
CVSS
9.2
Published
Collected

Related coverage

tool · github.com
Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)
Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · advisory · github.com
GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)
Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.
Back