AIKIDO-2026-862723

TL;DR

The ConstExprEvaluator component evaluates constant expressions extracted from parsed PHP code into PHP values. When an expression contains the pipe operator (|>), the evaluator resolves the right-hand operand and invokes it as a callable with the left-hand value, so an expression such as "id" |> "shell_exec" executes the named function. Applications that run the evaluator over untrusted or attacker-influenced PHP source can be induced to call arbitrary functions during constant-expression evaluation. The fix removes direct handling of the pipe operator and routes it to the fallback evaluator, which does not invoke callables.