{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Octo Image Server is typically installed on computers within a customer's internal network and is not intended to be directly exposed to the public internet.\nWhile the risk to installations is low, we recommend updating the PHP package to version 8.2.35 to eliminate any potential exposure and maintain current cybersecurity best practices.",
        "title": "Remediation"
      },
      {
        "category": "legal_disclaimer",
        "text": "Your use of the information on this document or materials linked from this document is at your own risk. METTLER TOLEDO makes reasonable efforts to ensure the accuracy of the information but does not grant any warranty, express or implied, including warranties of merchantability or fitness for a particular purpose. To the extent permitted by applicable law, METTLER TOLEDO excludes liability for any loss, claim, expense or damage arising from or related to the statements in this document. METTLER TOLEDO reserves the right to change or update this document at any time.",
        "title": "Disclaimer"
      },
      {
        "category": "description",
        "text": "A vulnerable PHP component in OCTO Image Server may allow remote code execution. An attacker could execute arbitrary code on the system hosting OCTO Image Server.",
        "title": "Impact"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@mt.com",
      "name": "Mettler-Toledo GmbH",
      "namespace": "https://www.mt.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Product security website of METTLER TOLEDO",
        "url": "https://www.mt.com/ph/en/home/site_content/product-security.html"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for METTLER TOLEDO",
        "url": "https://certvde.com/en/advisories/vendor/mettler-toledo/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-137: METTLER TOLEDO: PHP2Shell in Octo Image Server - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-137/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-137: METTLER TOLEDO: PHP2Shell in Octo Image Server - CSAF",
        "url": "https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json"
      }
    ],
    "title": "METTLER TOLEDO: PHP2Shell in Octo Image Server",
    "tracking": {
      "aliases": [
        "VDE-2026-137"
      ],
      "current_release_date": "2026-10-28T22:00:00.000Z",
      "generator": {
        "date": "2026-10-28T09:22:46.040Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-137",
      "initial_release_date": "2026-10-28T22:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-28T22:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:intdot/>=1.0.0|<=5.0.10",
                    "product": {
                      "name": "OCTO Image Server 5.0.10 and earlier",
                      "product_id": "CSAFPID-51000",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:mettler_toledo:octo_image_server:*:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "OCTO Image Server"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "METTLER TOLEDO"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP 8.2.35",
                  "product_id": "CSAFPID-52000",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:8.2.35:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=8.2.0|<=8.2.34",
                "product": {
                  "name": "PHP 8.2.0 to 8.2.34",
                  "product_id": "CSAFPID-51001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PHP"
          }
        ],
        "category": "vendor",
        "name": "PHP Group"
      }
    ],
    "relationships": [
      {
        "category": "external_component_of",
        "full_product_name": {
          "name": "PHP 8.2.0 to 8.2.34 external component of OCTO Image Server 5.0.10 and earlier",
          "product_id": "CSAFPID-31000",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:mettler_toledo:octo_image_server:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-51001",
        "relates_to_product_reference": "CSAFPID-51000"
      },
      {
        "category": "external_component_of",
        "full_product_name": {
          "name": "PHP 8.2.35 external component of OCTO Image Server 5.0.10 and earlier",
          "product_id": "CSAFPID-32000",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:mettler_toledo:octo_image_server:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-52000",
        "relates_to_product_reference": "CSAFPID-51000"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32000"
        ],
        "known_affected": [
          "CSAFPID-31000"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the PHP component of OCTO Image Server 5.0.10 and earlier to PHP 8.2.35",
          "product_ids": [
            "CSAFPID-31000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31000"
          ]
        }
      ],
      "title": "RCE via OOM corruption"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32000"
        ],
        "known_affected": [
          "CSAFPID-31000"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the PHP component of OCTO Image Server 5.0.10 and earlier to PHP 8.2.35",
          "product_ids": [
            "CSAFPID-31000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31000"
          ]
        }
      ],
      "title": "RCE via stale global state"
    }
  ]
}