) auf die Platte geschrieben -> Webshell.
// Bewusst nicht auf "pearcmd" als Keyword eingeschraenkt, da sich das Angriffsziel (jede per
// Path Traversal erreichbare, includebare Datei) aendern kann -> generisch auf "../.." und "<?".
$mc_waf_pearLang = isset($_GET['lang']) && is_string($_GET['lang']) ? $_GET['lang'] : '';
$mc_waf_pearQs   = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
if (
    $mc_waf_pearLang !== ''
    && strpos($mc_waf_pearLang, '../..') !== false
    && (
        strpos($mc_waf_pearQs, '<?') !== false
        || strpos(urldecode($mc_waf_pearQs), '<?') !== false
    )
) {
    file_put_contents("/tmp/mc-microwaf.log",
        date('Y-m-d H:i:s')
        . " - CVE-2026-87902: Blocked pearcmd LFI/RCE attempt"
        . " from " . $_SERVER['REMOTE_ADDR']
        . " (X-Forwarded-For: " . $mc_waf_xForwardedFor . ") "
        . "to " . $_SERVER['REQUEST_URI']
        . "\n", FILE_APPEND | LOCK_EX);
    mc_waf_block('CVE-2026-87902');
}

//StyleSmuggler: https://sansec.io/research/stylesmuggler
// Portierung der nginx-/VCL-Regeln (accord_rce).
// 1. Block "/paypal/transparent/response/"
if (stripos($_SERVER['REQUEST_URI'], '/paypal/transparent/response/') !== false) {
    mc_waf_block('StyleSmuggler', 'VCL');
}

// Layer 0/1: Query-String, routenunabhaengig.
// Keine Admin-Ausnahme wie in der VCL, weil der Admin-Frontname pro Installation
// individuell ist und sich nicht generisch erkennen laesst.
$mc_waf_ssQs = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
if ($mc_waf_ssQs !== '') {
    // drei Paesse kollabieren bis zu 3-fach-Encoding, qs2 dient als Rest-%-Detektor fuer >=4x
    $mc_waf_ssQs2 = urldecode(urldecode($mc_waf_ssQs));
    $mc_waf_ssQs3 = urldecode($mc_waf_ssQs2);

    // Layer 0: PHP-Open-Tag im QS (Stage-1A File-Plant)
    if (strpos($mc_waf_ssQs3, '<?') !== false) {
        mc_waf_block('StyleSmuggler-L0', 'VCL');
    }

    // Layer 1a: styles[] in jeder Encoding-Tiefe.
    // $_GET-Key deckt einfaches Encoding ab, weil PHP vor dem Klammer-Parsing dekodiert.
    if (
        isset($_GET['styles'])
        || preg_match('@styles\s*\[@i', $mc_waf_ssQs3)
        || preg_match('@styles\s*%@i', $mc_waf_ssQs2)
    ) {
        mc_waf_block('StyleSmuggler-L1a', 'VCL');
    }

    // Layer 1b: Template-Direktive in text-Parametern (text=, text[]=, text[0]=, ...)
    // [\s+]* statt \s*, weil ein Leerzeichen im QS als '+' ankommt
    if (
        stripos($mc_waf_ssQs3, '{{') !== false
        && preg_match('@(^|[&;])text[^=&;]*=[^&;]*\{\{[\s+]*(block|widget|layout|config|template|store|trans|media|view|var|if|depend|inlinecss|css|customvar|for|protocol)\b@i', $mc_waf_ssQs3)
    ) {
        mc_waf_block('StyleSmuggler-L1b', 'VCL');
    }
}

// Layer 2: Request-Body
if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT') {
    $mc_waf_ssBody = $mc_waf_input;
    if ($mc_waf_ssBody === '' && !empty($_POST)) {
        // php://input ist bei multipart/form-data leer
        $mc_waf_ssBody = http_build_query($_POST);
    }

    // ohne ^-Anker: faengt Store-Code-Praefixe, /index.php/... und Unterverzeichnis-Installationen
    // zweite Alternative deckt JSON-Notation ab, auch mit escapten Quotes in verschachtelten Strings
    if (
        preg_match('@(^|/)(graphql|paypal|rest|sales|multishipping|newsletter)(/|\?|$)@i', $_SERVER['REQUEST_URI'])
        && preg_match('@styles\s*(\[|%5b)|\\\\?"styles\\\\?"\s*:\s*\[@i', $mc_waf_ssBody)
    ) {
        mc_waf_block('StyleSmuggler-L2b', 'VCL');
    }

    // engere Routenliste als bei L2b: /rest, /sales und /newsletter fuehren im Backend
    // legitim Direktiven im Body (CMS-API, Newsletter-Templates, Order-Comments)
    if (
        preg_match('@(^|/)(graphql|paypal|multishipping)(/|\?|$)@i', $_SERVER['REQUEST_URI'])
        && stripos($mc_waf_ssBody, '{{') !== false
        && preg_match('@\{\{[\s+]*(block|widget|layout|config|template|store|trans|media|view|var|if|depend|inlinecss|css|customvar|for|protocol)\b@i', $mc_waf_ssBody)
    ) {
        mc_waf_block('StyleSmuggler-L2a', 'VCL');
    }
}<!DOCTYPE html><html><head><meta charset="utf-8"><title>    An error occurred
</title><meta name="generator" content="Contao Open Source CMS"><meta name="viewport" content="width=device-width,initial-scale=1.0,shrink-to-fit=no"><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Open+Sans:300"><style>
                html {
                    background: #fff;
                }
                body {
                    margin: 0;
                    padding: 0;
                    font: 16px "Open Sans", Helvetica, sans-serif;
                    font-weight: 300;
                    color: #333;
                }
                a, a:visited {
                    text-decoration: none;
                    color: #e4790f;
                }
                a:hover {
                    text-decoration: underline;
                }
                h1, h2, h3 {
                    font-weight: 300;
                }
                h1 {
                    margin: 0;
                    padding-bottom: 2%;
                    font-size: 3em;
                }
                h2, h3 {
                    font-size: 1.5em;
                }
                #header {
                    padding: 12px 0 10px;
                }
                #content {
                    padding: 3% 0;
                    background-color: #eee;
                }
                #footer {
                    font-size: 0.75em;
                    text-align: center;
                    padding: .5em 0;
                    color: #999;
                }
                .wrap {
                    width: 60%;
                    margin: 0 auto;
                    padding: 1em;
                    overflow: hidden;
                }
                .header-logo {
                    display: inline-block;
                }
                .search {
                    display: inline-block;
                    float: right;
                    margin-top: 12px;
                }
                .block-error {
                    margin-bottom: 20px;
                    background-color: #fff;
                    border: 1px solid #dfdfdf;
                    border-radius: 16px;
                    padding: 15px 30px 24px;
                    word-wrap: break-word;
                    overflow: hidden;
                }
                .block-error:before {
                    float: left;
                    content: "</";
                    font-size: 5em;
                    color: #ccc;
                }
                .block-error .inner {
                    padding-left: 13%;
                }
                input {
                    background: #fff;
                    padding: 6px;
                    border: 1px solid #dfdfdf;
                    border-radius: 3px;
                    font-family: inherit;
                    font-size: 14px;
                    line-height: 16px;
                }
                input[type="search"] {
                    width: 15em;
                    margin-right: 6px;
                }
                button {
                    border: 0;
                    background: #fff;
                    margin: 0;
                    padding: 0;
                    position: relative;
                    top: 3px;
                    cursor: pointer;
                }
            </style></head><body><div id="header"><div class="wrap"><div class="header-logo"><img width="200" height="54" src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1NzQuMDIiIGhlaWdodD0iMTU1LjkxIiB2aWV3Qm94PSIwIDAgNTc0LjAyIDE1NS45MSI+PHBhdGggZD0iTTI3MS4wMSAxMjEuNDRhMzEuNDUgMzEuNDUgMCAwIDEtMjMuMDctOS4zOGMtOC42NC04LjY1LTguNDItMTkuMzQtOC40Mi0zNC4xcy0uMjMtMjUuNDYgOC40Mi0zNC4xMmEzMS41IDMxLjUgMCAwIDEgMjMuMDctOS4zOGMxNiAwIDI4LjQ3IDkuMTMgMzEuNDggMjdoLTE3Yy0xLjY4LTYuODUtNi0xMi4xMi0xNC40MS0xMi4xMmExMy44NCAxMy44NCAwIDAgMC0xMC42OCA0LjQxYy0zLjI1IDMuNjQtNC4yMiA3LjctNC4yMiAyNC4xN3MxIDIwLjUxIDQuMjIgMjQuMTRhMTMuODMgMTMuODMgMCAwIDAgMTAuNjggNC40M2M4LjQxIDAgMTIuNzMtNS4yOCAxNC40MS0xMi4xMmgxN2MtMy4wMSAxNy45My0xNS42MiAyNy4wNy0zMS40OCAyNy4wN3ptODIuMjgtNy42OWMtMy44NCA0LjA5LTEwLjIxIDcuNjktMTkuNDYgNy42OXMtMTUuNS0zLjYxLTE5LjM1LTcuNjljLTUuNjQtNS44OC03LjA4LTEzLTcuMDgtMjQuMzhzMS40NC0xOC4zOCA3LjA4LTI0LjI4YzMuODUtNC4wOCAxMC4xLTcuNjYgMTkuMzUtNy42NnMxNS42MSAzLjU4IDE5LjQ2IDcuNjZjNS42NSA1Ljg5IDcuMDkgMTMgNy4wOSAyNC4yOHMtMS40MyAxOC40OS03LjA4IDI0LjM3em0tMTIuMTQtMzkuNTJhOS44NiA5Ljg2IDAgMCAwLTcuMzItMi43NiA5LjYzIDkuNjMgMCAwIDAtNy4yMiAyLjc2Yy0zLjIzIDMuMjUtMy42IDguNjQtMy42IDE1LjE0cy4zNyAxMiAzLjYgMTUuMjNhOS42IDkuNiAwIDAgMCA3LjIyIDIuNzkgOS44MyA5LjgzIDAgMCAwIDcuMzItMi43OWMzLjI1LTMuMjQgMy42MS04Ljc2IDMuNjEtMTUuMjNzLS4zNS0xMS44OS0zLjYtMTUuMTR6bTYzLjQxIDQ2LjQ5VjgyLjg3YzAtOC41My01LjQtMTEuNC0xMC4zMy0xMS40cy0xMC40NCAyLjg3LTEwLjQ0IDExLjR2MzcuODRoLTE1LjYzVjU4LjEyaDE1LjI4djUuNzhhMjEuMzMgMjEuMzMgMCAwIDEgMTUuNi02LjQ4YzYuMjYgMCAxMS4zIDIgMTQuNzggNS41MyA1LjA2IDUgNi4zNyAxMC45IDYuMzcgMTcuNzZ2NDB6bTQ1LjE2IDBjLTEyLjczIDAtMTguMTUtOS0xOC4xNS0xNy45MXYtMzFoLTYuNTZWNTkuOTVoNi42di0xOC41YzYuNTMgMCAxNS42My0zLjQzIDE1LjYzLTMuNDN2MjEuOTNoMTF2MTEuODloLTExdjMwYzAgMy42IDEuNjkgNS42NSA1LjQyIDUuNjVoNS42M3YxMy4yMXptNDkgMHYtNS40Yy00LjIgNC4yMi04LjE2IDYtMTUuMzcgNnMtMTIuMjUtMS43OS0xNi01LjU0YTIwLjA4IDIwLjA4IDAgMCAxLTUuMTYtMTQuMDZjMC0xMCA2Ljg0LTE4LjEyIDIxLjM4LTE4LjEyaDE0Ljc2di0zLjEzYzAtNi44My0zLjM0LTkuODYtMTEuNjMtOS44Ni02IDAtOC43NyAxLjQ1LTEyIDUuMThsLTEwLTkuNzNjNi4xMy02LjczIDEyLjE0LTguNjMgMjIuNTktOC42MyAxNy41NCAwIDI2LjY2IDcuNDMgMjYuNjYgMjIuMDl2NDEuMnptLS4zNy0yNi40MWgtMTIuMzRjLTUuNjUgMC04Ljc3IDIuNjMtOC43NyA3LjA2czIuODggNy4yMSA5IDcuMjFjNC4zMSAwIDcuMDktLjM0IDkuODQtMyAxLjY3LTEuNTcgMi4yNy00LjA3IDIuMjctNy45M3ptNjguNjMgMTkuNDVjLTMuODQgNC4wOS0xMC4yMSA3LjY5LTE5LjQ3IDcuNjlzLTE1LjUtMy42MS0xOS4zNC03LjY5Yy01LjY1LTUuODgtNy4wOC0xMy03LjA4LTI0LjM4czEuNDMtMTguMzggNy4wOC0yNC4yOGMzLjg0LTQuMDggMTAuMDktNy42NiAxOS4zNC03LjY2czE1LjYzIDMuNTggMTkuNDcgNy42NmM1LjY0IDUuODkgNy4wNyAxMyA3LjA3IDI0LjI4cy0xLjQ2IDE4LjQ4LTcuMSAyNC4zNnptLTEyLjEzLTM5LjUyYTkuOTEgOS45MSAwIDAgMC03LjM0LTIuNzYgOS41NiA5LjU2IDAgMCAwLTcuMiAyLjc2Yy0zLjI1IDMuMjUtMy42MiA4LjY0LTMuNjIgMTUuMTRzLjM3IDEyIDMuNjIgMTUuMjNhOS41MyA5LjUzIDAgMCAwIDcuMiAyLjc5IDkuODggOS44OCAwIDAgMCA3LjM0LTIuNzljMy4yMy0zLjI0IDMuNTktOC43NiAzLjU5LTE1LjIzcy0uNDMtMTEuOS0zLjYyLTE1LjE1eiIgZmlsbD0iI2Y0N2MwMCIvPjxwYXRoIGQ9Ik0xMS44Mi0uMDVBMTEuODEgMTEuODEgMCAwIDAgLjAxIDExLjc0djEzMi40MmExMS44MSAxMS44MSAwIDAgMCAxMS44MSAxMS43OWgxNTQuOTVhMTEuODEgMTEuODEgMCAwIDAgMTEuODItMTEuNzRWMTEuNzRBMTEuODEgMTEuODEgMCAwIDAgMTY2Ljc3LS4wNXoiIGZpbGw9IiNmZmYiLz48cGF0aCBkPSJNMTUuODggOTQuNTVjNSAyMy4yNiA5LjE2IDQ1LjQxIDIzLjczIDYxLjM1SDExLjgyQTExLjgxIDExLjgxIDAgMCAxIC4wMSAxNDQuMTZWMTEuNzRBMTEuODEgMTEuODEgMCAwIDEgMTEuODItLjA1SDMxLjlhNzYuOCA3Ni44IDAgMCAwLTEyLjc4IDE1LjFjLTE1Ljg5IDI0LjM1LTkuMzYgNTAuOS0zLjI0IDc5LjV6TTE2Ni43Ny0uMDVoLTMxLjUxYzcuNDYgNy40NiAxMy43NSAxNy4xMiAxOC41IDI5LjEzbC00Ny45IDEwLjExYy01LjI1LTEwLjA2LTEzLjIzLTE4LjQzLTI4Ljg0LTE1LjE0LTguNjEgMS44Mi0xNC4zMiA2LjY1LTE2Ljg1IDExLjk0LTMuMTEgNi41Mi00LjY0IDEzLjgzIDIuOCA0OC41N3MxMS44MiA0MC44IDE3LjMyIDQ1LjVjNC40NyAzLjggMTEuNjggNS45MSAyMC4yOSA0LjA5IDE1LjYyLTMuMjkgMTkuNDctMTQuMTYgMjAuMTUtMjUuNDdsNDcuOS0xMC4xMmMxLjEzIDI0Ljc4LTYuNTQgNDQtMjAuMDggNTcuMjloMTguMjJhMTEuODEgMTEuODEgMCAwIDAgMTEuODItMTEuNzRWMTEuNzRBMTEuODEgMTEuODEgMCAwIDAgMTY2Ljc3LS4wNXoiIGZpbGw9IiNmNDdjMDAiLz48L3N2Zz4K" alt="Contao Open source CMS"/></div><div class="search"><form method="get" action="https://contao.org/search.html" target="_blank"><div class="form-row"><input name="keywords" id="search-id" type="search" placeholder="Search on contao.org"><button type="submit"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAABUElEQVQoz2NgAIJ29iBdD0d7X2cPb+tY2f9MDMjgP2O2hKu7vS8CBlisZUNSMJ3fxRMkXO61wm2ue6I3iB1q8Z8ZriDZFCS03fm/wX+1/xp/TBo8QPxeqf+MUAW+QIFKj/+q/wX/c/3n/i/6Qd/bx943z/Q/K1SBI1D9fKv/AhCn/Wf5L5EHdFGKw39OqAIXoPpOMziX4T9/DFBBnuN/HqhAEtCKCNf/XDA/rZRyAmrpsvrPDVUw3wrkqCiLaewg6TohX1d7X0ffs5r/OaAKfinmgt3t4ulr4+Xg4ANip3j+l/zPArNT4LNOD0pAgWCSOUIBy3+h/+pXbBa5tni0eMx23+/mB1YSYnENroT5Pw/QSOX/mkCo+l/jgo0v2KJA643s8PgAmsMBDCbu/5xALHPB2husxN9uCzsDOgAq5kAoaZVnYMCh5Ky1r88Eh/+iABM8jUk7ClYIAAAAAElFTkSuQmCC" alt="Search on contao.org"></button></div></form></div></div></div><div id="content"><div class="wrap"><div class="error"><h1>    An error occurred
</h1><div class="block-error"><div class="inner"><div class="text-error"><h2>What&#039;s the matter?</h2><p>An error occurred while executing this script. Something does not work properly.</p><h2>How can I fix the issue?</h2><p>Open the current log file in the <code>var/logs</code> or <code>app/logs</code> directory and find the associated error message (usually the last one).</p><h3>Tell me more, please</h3><p>The script execution stopped, because something does not work properly. The actual error message is hidden by this notice for security reasons and can be found in the current log file (see above). If you do not understand the error message or do not know how to fix the problem, search the <a href="https://contao.org/faq.html" target="_blank">Contao FAQs</a> or visit the <a href="https://contao.org/support.html" target="_blank">Contao support page</a>.</p></div></div></div></div></div></div><div id="footer"><div class="wrap">
            To customize this notice, create a custom Twig template overriding <em>@ContaoCore/Error/error.html.twig</em>.        </div></div></body></html>