NativePHP for Mobile Patches Seven Security Vulnerabilities
NativePHP has released versions 4.6.1 and 3.3.11 to address seven critical and moderate security flaws, requiring developers to rebuild and redeploy their mobile applications.
NativePHP for Mobile version 4.6.1 and 3.3.11 fix seven security advisories. You need to update nativephp/mobile, run php artisan native:install --force, rebuild, and ship new app store releases. Installed builds remain vulnerable until updated. Versions 1.x and 2.x are end-of-life.
Most advisories stem from internal /_native/api/* routes lacking middleware, with bridge functions trusting input. Exploiting most requires an attacker running script on the app's origin.
Five High-rated advisories:
- GHSA-9884-fw9c-mq85 (8.1, 4.5.0–4.6.0): Non-UUID task IDs spliced into PHP code for async tasks.
- GHSA-83jv-8h7x-287p (7.7, 3.0.0–3.3.10 and 4.0.0–4.6.0): Events endpoint instantiated arbitrary autoloadable classes like
SplFileObject. Events must now implementNative\Mobile\Events\Contracts\DispatchableFromNative. - GHSA-3w4w-cchh-qvrw (7.7, 4.0.0–4.6.0):
File.MoveandFile.Copynow confine paths tostorage_path('app'). - GHSA-7927-vv5p-fv4f (7.7,
nativephp/mobile-filebefore 1.0.3): Companion flaw. - GHSA-9g37-88p8-75j2 (7.4, 4.5.0–4.6.0): Async task runner passed task files to
unserialize(). Payloads are now encrypted and bound to the task ID.
Two Moderate issues: GHSA-76px-r497-93p9 (5.9) fixed path traversal in /_assets. GHSA-27jx-7m9x-fx5c (4.1) fixed Android release builds logging cookie values. Update the plugin to 1.0.3 on 3.x, or remove nativephp/mobile-file on 4.x.
Six issues came from researcher acd421 via RedEye Security, and aragossa reported the Android logging issue.
PHP versions 8.5.12, 8.4.27, and 8.3.36 patch CVE-2026-109618 and CVE-2026-109619. NativePHP rebuilt all distributed binaries on these releases. Desktop users upgrading to nativephp/desktop 2.4 can remove nativephp/php-bin via composer.