CVE-2026-41249: CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

The GitHub Actions workflow (.github/workflows/static.yml) uses the pull_request_target trigger but dangerously checks out the unverified code from the pull request head (ref: ${{ github.event.pull_request.head.ref }}). Subsequently, it executes a script (bin/console) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a “Pwn Request” vulnerability.

Steps to Reproduce:

1. Fork the target repository.
2. In the forked repository, modify a file that satisfies the paths condition (e.g., src/dummy.php or composer.json) to trigger the workflow.
3. Modify the bin/console file (which is executed in the workflow steps) with the following malicious payload: