StackRadar

CVE-2026-25129

Medium

Advisory

Published 30 Jan 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.7
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
1 of 1
affected package

PsySH has Local Privilege Escalation via CWD .psysh.php auto-load

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
psy/psyshcomposerv0.4.4, v0.7.2, v0.9.12, v0.10.7+11 more0.11.23, 0.12.1923
OSV records
GHSA-4486-gxhx-5mg7

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
psy/psysh@v0.11.7
0.11.23

Open the chart page →

18,509
mauticone-acre-fundVerified publisher0.1.71 of 3See more

mautic one-acre-fund 0.1.7

1 of the 3 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
mautic/mautic:v4-apache94ea4acf4049
psy/psysh@v0.10.12
0.11.23

Open the chart page →

2,667
bookstackgabe565Verified publisher0.20.01 of 1See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
psy/psysh@v0.12.7
0.12.19

Open the chart page →

2,811
invoiceninjainvoiceninjaVerified publisher0.10.21 of 5See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
invoiceninja/invoiceninja:5.6.241437916dee01
psy/psysh@v0.11.19
0.11.23

Open the chart page →

2,709
cachetdeliveryheroVerified publisher1.3.51 of 2See more

cachet deliveryhero 1.3.5

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
psy/psysh@v0.7.2
0.11.23

Open the chart page →

1,896
laravelrenoki-co1.0.01 of 2See more

laravel renoki-co 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
psy/psysh@v0.10.7
0.11.23

Open the chart page →

6,931
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
psy/psysh@v0.12.16
0.12.19

Open the chart page →

4,333
librenmsmidokura-communityVerified publisher0.3.21 of 6See more

librenms midokura-community 0.3.2

1 of the 6 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
librenms/librenms:22.4.14f1f3d667cc7
psy/psysh@v0.11.1
0.11.23

Open the chart page →

8,967
laravel-octanerenoki-co1.0.01 of 1See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
psy/psysh@v0.10.7
0.11.23

Open the chart page →

3,634
cachetadnoctemVerified publisher0.3.31 of 2See more

cachet adnoctem 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
psy/psysh@v0.7.2
0.11.23

Open the chart page →

1,896
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
n22107670/sample-app:0.4.08f3072db7aeb
psy/psysh@v0.11.20
0.11.23

Open the chart page →

1,775
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
psy/psysh@v0.12.0
0.12.19

Open the chart page →

1,664
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
psy/psysh@v0.11.7
0.11.23

Open the chart page →

4,788
bookstackgeek-cookbookVerified publisher5.2.01 of 1See more

bookstack geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
psy/psysh@v0.10.12
0.11.23

Open the chart page →

1,269
cachethelm-charts-nr1.3.51 of 2See more

cachet helm-charts-nr 1.3.5

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
psy/psysh@v0.7.2
0.11.23

Open the chart page →

1,896
sample-appkubeuest0.1.31 of 1See more

sample-app kubeuest 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
michaelepitech/sample-app:latestaf51d61c19f5
psy/psysh@v0.11.20
0.11.23

Open the chart page →

1,427
freescoutl4gVerified publisher0.1.01 of 3See more

freescout l4g 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
tiredofit/freescout:php8.2-1.17.725b7cc0658f07
psy/psysh@v0.9.12
0.11.23

Open the chart page →

5,332
laravel-chartlaravel-application0.2.01 of 1See more

laravel-chart laravel-application 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
ibarreche/cloud-back-ci:lateste16a469c5791
psy/psysh@v0.9.12
0.11.23

Open the chart page →

1,835
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
psy/psysh@v0.11.18
0.11.23

Open the chart page →

12,813
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
psy/psysh@v0.12.4
0.12.19

Open the chart page →

2,293
podcast-helmpodcastwala-helm0.1.01 of 2See more

podcast-helm podcastwala-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
shivani446/podcastwala-php:v1c0d07b7b4c8d
psy/psysh@v0.4.4
0.11.23

Open the chart page →

621
laravel-workerrenoki-co1.1.01 of 1See more

laravel-worker renoki-co 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
psy/psysh@v0.10.7
0.11.23

Open the chart page →

5,687
bookstackschmitzis0.1.11 of 1See more

bookstack schmitzis 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
solidnerd/bookstack:21.12762ffd5c51d3
psy/psysh@v0.10.12
0.11.23

Open the chart page →

2,751
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
psy/psysh@v0.12.9
0.12.19

Open the chart page →

6,094
cachetsergiotocaliniVerified publisher1.0.01 of 1See more

cachet sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
psy/psysh@v0.7.2
0.11.23

Open the chart page →

1,896
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-25129.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
psy/psysh@v0.11.1
0.11.23

Open the chart page →

2,019

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
cachethq/docker:2.3.15a61ff0f67ea7
psy/psysh@v0.7.2
0.11.23
4
akaunting/akaunting:3.0.1552811b36ec3a
psy/psysh@v0.11.18
0.11.23
1
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
psy/psysh@v0.12.16
0.12.19
1
anonaddy/anonaddy:0.12.3957a95565166
psy/psysh@v0.11.7
0.11.23
1
ibarreche/cloud-back-ci:lateste16a469c5791
psy/psysh@v0.9.12
0.11.23
1
invoiceninja/invoiceninja:5.6.241437916dee01
psy/psysh@v0.11.19
0.11.23
1
librenms/librenms:24.11.00920bc9117a8
psy/psysh@v0.12.4
0.12.19
1
librenms/librenms:22.4.14f1f3d667cc7
psy/psysh@v0.11.1
0.11.23
1
linuxserver/heimdall:2.6.371597f4461e4
psy/psysh@v0.12.0
0.12.19
1
mautic/mautic:v4-apache94ea4acf4049
psy/psysh@v0.10.12
0.11.23
1
michaelepitech/sample-app:latestaf51d61c19f5
psy/psysh@v0.11.20
0.11.23
1
n22107670/sample-app:0.4.08f3072db7aeb
psy/psysh@v0.11.20
0.11.23
1
shivani446/podcastwala-php:v1c0d07b7b4c8d
psy/psysh@v0.4.4
0.11.23
1
snipe/snipe-it:v8.3.1141ebf2386fe
psy/psysh@v0.12.9
0.12.19
1
snipe/snipe-it:v6.0.1455fb7636a98c
psy/psysh@v0.11.7
0.11.23
1
solidnerd/bookstack:21.12762ffd5c51d3
psy/psysh@v0.10.12
0.11.23
1
tiredofit/freescout:php8.2-1.17.725b7cc0658f07
psy/psysh@v0.9.12
0.11.23
1
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
psy/psysh@v0.12.7
0.12.19
1
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
psy/psysh@v0.10.12
0.11.23
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
psy/psysh@v0.11.1
0.11.23
1
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
psy/psysh@v0.10.7
0.11.23
1
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
psy/psysh@v0.10.7
0.11.23
1
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
psy/psysh@v0.10.7
0.11.23
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.