Information about the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109609) in the context of VertiGIS Integrator (UT Integrator)

VertiGIS Integrator contains various PHP files in the included Dojo Framework. VertiGIS Integrator itself does not use PHP technology and does not contain a PHP runtime environment. Since Apache Tomcat does not execute PHP files by default, these files do not pose a direct security risk in a standard installation. A risk exists only if a PHP runtime environment has also been installed and configured accordingly on the server.

Whether a PHP runtime environment is present or active on the server can be checked, for example, with the following commands:

• php -v                             Checks whether a PHP runtime environment is installed.
• ps -ef | grep php        Checks whether PHP processes are running. 

If no PHP runtime environment is installed or active, the included PHP files cannot be executed.

Regardless, we recommend removing the *.php files, as they are not required to operate the applications.

In older versions, the Dojo Framework is provided as a directory within the web application:

TOMCAT]/webapps/utpostserver/dojo*

The included *.php files can be deleted directly from the corresponding subdirectories. In newer versions, the Dojo Framework is located in a Web JAR.

[TOMCAT]/webapps/utpostserver/WEB-INF/lib/dojo*.jar

Since JAR files correspond to the ZIP format, they can be opened with common tools such as 7-Zip. The included *.php files can then be removed from the archive. Alternatively, a cleaned Dojo Web JAR can be requested through VertiGIS Support.