Home

Description

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

PUBLISHED Reserved 2026-01-27 | Published 2026-02-12 | Updated 2026-02-12 | Assigner GitHub_M




HIGH: 8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Problem types

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize

Product status

< 1.11.2
affected

References

github.com/...kenphp/security/advisories/GHSA-g966-83w7-6w38

github.com/...ommit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e

github.com/php/frankenphp/releases/tag/v1.11.2

cve.org (CVE-2026-24895)

nvd.nist.gov (CVE-2026-24895)

Download JSON